59848 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

ENVIRONMENTAL PROTECTION 

AGENCY 

40 CFR Parts 3, 9, 51, 60, 63, 69, 70, 

71, 123, 142, 145, 162, 233, 257, 258, 

271, 281, 403, 501, 745 and 763 

[FRL–7977–1] 

RIN 2025–AA07 

Cross-Media Electronic Reporting 

AGENCY: Environmental Protection 

Agency (EPA). 

ACTION: Final rule. 

SUMMARY: EPA is establishing the 

framework by which it will accept 

electronic reports from regulated 

entities in satisfaction of certain 

document submission requirements in 

EPA’s regulations. EPA will provide 

public notice when the Agency is ready 

to receive direct submissions of certain 

documents from regulated entities in 

electronic form consistent with this 

rulemaking via an EPA electronic 

document receiving system. This rule 

does not mandate that regulated entities 

utilize electronic methods to submit 

documents in lieu of paper-based 

submissions. In addition, EPA is not 

taking final action on the electronic 

recordkeeping requirements at this time. 

States, tribes, and local governments 

will be able to seek EPA approval to 

accept electronic documents to satisfy 

reporting requirements under 

environmental programs that EPA has 

delegated, authorized, or approved them 

to administer. This rule includes 

performance standards against which a 

state’s, tribe’s, or local government’s 

electronic document receiving system 

will be evaluated before EPA will 

approve changes to the delegated, 

authorized, or approved program to 

provide electronic reporting, and 

establishes a streamlined process that 

states, tribes, and local governments can 

use to seek and obtain such approvals. 

DATES: This rule shall become effective 

January 11, 2006. 

ADDRESSES: The public record for this 

rulemaking has been established under 

docket number OEI–2003–0001 and is 

located in the EPA Docket Center, (EPA/ 

DC) EPA West, Room B102, 1301 

Constitution Ave., NW., Washington, 

DC. The EPA Docket Center Public 

Reading Room is open from 8:30 a.m. to 

4:30 p.m., Monday through Friday, 

excluding legal holidays. (See 

SUPPLEMENTARY INFORMATION below.) 

FOR FURTHER INFORMATION CONTACT: For 

general information on this final rule, 

contact the docket above. For more 

detailed information on specific aspects 

of this rulemaking, contact David 

Schwarz (2823T), Office of 

Environmental Information, U.S. 

Environmental Protection Agency, 1200 

Pennsylvania Avenue, NW., 

Washington, DC 20460, (202) 566–1704, 

schwarz.david@epa.gov, or Evi Huffer 

(2823T), Office of Environmental 

Information, U.S. Environmental 

Protection Agency, 1200 Pennsylvania 

Avenue, NW., Washington, DC 20460, 

(202) 566–1697, huffer.evi@epa.gov. 

SUPPLEMENTARY INFORMATION: 

General Information 

A. Affected Entities 

This rule will potentially affect states, 

tribes, and local governments that have 

been delegated, authorized, or 

approved, or which seek delegation, 

authorization, or approval to administer 

a federal environmental program under 

Title 40 of the Code of Federal 

Regulations (CFR). For purposes of this 

rulemaking, the term ‘‘state’’ includes 

the District of Columbia and the United 

States territories, as specified in the 

applicable statutes. That is, the term 

‘‘state’’ includes the District of 

Columbia, the Commonwealth of Puerto 

Rico, the Virgin Islands, Guam, 

American Samoa, the Commonwealth of 

Northern Marina Islands, and the Trust 

Territory of the Pacific Islands, 

depending on the statute. 

The rule will also potentially affect 

private parties subject to any 

requirements in Title 40 of the CFR that 

require a document to be submitted to 

EPA. Affected Entities include, but are 

not necessarily limited to: 

Category Examples of affected entities 

Local government ............... Publicly owned treatment works, owners and operators of treatment works treating domestic sewage, local and regional air boards, local and regional waste management authorities, and municipal and other drinking water authorities. 

Private ................................ Industry owners and operators, waste transporters, privately owned treatment works or other treatment works 

treating domestic sewage, privately owned water works, small businesses of various kinds, sponsors such as 

laboratories that submit or initiate/support studies, and testing facilities that both initiate and conducts studies. 

Tribe and State governments.States, tribes or territories that administer any federal environmental programs delegated, authorized, or approved 

by EPA under Title 40 of the CFR. 

Federal government ........... Federally owned treatment works and industrial dischargers, and federal facilities subject to hazardous waste regulation. 

This table is not intended to be 

exhaustive, but rather provides a guide 

for readers regarding entities likely to be 

affected by this action. This table lists 

the types of entities that EPA is now 

aware can potentially be affected by this 

action. Other types of entities not listed 

in the table can also be affected. If you 

have questions regarding the 

applicability of this action to a 

particular entity, consult the person 

listed in the preceding FOR FURTHER

INFORMATION CONTACT section. 

B. How Can I Get Copies of This 

Document and Other Related 

Information? 

1. Docket. EPA has established an 

official public docket for this action 

under Docket ID No. OEI–2003–0001. 

The official public docket consists of the 

documents specifically referenced in 

this action, any public comments 

received, and other information related 

to this action. Although a part of the 

official docket, the public docket does 

not include Confidential Business 

Information (CBI) or other information 

whose disclosure is restricted by statute. 

The official public docket is the 

collection of materials that is available 

for public viewing at the Cross-Media 

Electronic Reporting Rule (CROMERR) 

Docket in the EPA Docket Center (EPA/ 

DC), EPA West, Room B102, 1301 

Constitution Ave., NW., Washington, 

DC. The EPA Docket Center Public 

Reading Room is open from 8:30 a.m. to 

4:30 p.m., Monday through Friday, 

excluding legal holidays. The telephone 

number for the Public Reading Room is 

(202) 566–1744, and the telephone 

number for the Office of Environmental 

Information Docket is (202) 566–1752. 

You may have to pay a reasonable fee 

for copying. 

An electronic version of the public 

docket is available through EPA’s 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59849 

electronic public docket and comment 

system, EDOCKET. You may use 

EDOCKET at http://www.epa.gov/ 

edocket/ to view public comments, 

access the index listing of the contents 

of the official public docket, and to 

access those documents in the public 

docket that are available electronically. 

Although not all docket materials may 

be available electronically, you may still 

access any of the publicly available 

docket materials. After selecting the 

‘‘Using EDOCKET’’ icon, select ‘‘quick 

search,’’ then key in the appropriate 

docket identification number. Double 

click on the document identification 

number to bring up the docket contents. 

2. Electronic Access. You may access 

this Federal Register document 

electronically through the EPA Internet 

under the ‘‘Federal Register’’ listings at 

http://www.epa.gov/fedrgstr/. 

Organization of This Document 

Information in this Preamble is 

organized as follows: 

I. Overview 

A. Why does the Agency seek to provide 

electronic alternatives to paper-based 

reporting and recordkeeping? 

B. What does the electronic reporting rule 

do? 

C. What is the status of the proposed 

electronic recordkeeping provisions? 

D. How were stakeholders consulted 

during the development of today’s final 

rule? 

E. What alternatives to today’s final rule 

did EPA consider? 

II. Background 

A. What has been EPA’s electronic 

reporting policy? 

B. How does today’s final rule change 

EPA’s electronic reporting policy? 

III. Scope of the Electronic Reporting Rule 

A. Who may submit electronic documents? 

B. Which documents can be filed 

electronically? 

C. How does this final rule implement 

electronic reporting? 

IV. Major Changes from Proposed Electronic 

Reporting Provisions 

A. How does the rule streamline the 

approval of electronic reporting under 

authorized state, tribe, and local 

government programs? 

1. Review of the proposal 

2. Comments on the proposal 

3. Revisions in the final rule 

B. How has EPA revised the requirements 

that state, tribe, and local government 

electronic reporting programs must 

satisfy? 

1. Review of the proposal 

2. Comments on the proposed criteria for 

electronic document receiving systems 

3. Revisions to the criteria in the final rule 

C. How has EPA accommodated electronic 

submissions with follow-on paper 

certifications? 

D. How has EPA changed proposed 

definitions of terms? 

1. Definition of ‘‘acknowledgment’’

2. Definition of ‘‘electronic document’’

3. Definition of ‘‘electronic signature’’

4. Definition of ‘‘electronic signature 

device’’

5. Definition of ‘‘transmit’’

6. Definition of ‘‘valid electronic signature’’

V. Requirements for Direct Electronic 

Reporting to EPA 

A. What are the requirements for electronic 

reporting to EPA? 

B. What is the status of existing electronic 

reporting to EPA? 

C. What is EPA’s Central Data Exchange? 

1. Overview of general goals 

2. Comments on the proposal 

3. The aspects of CDX that have not 

changed since proposal 

4. The major changes that EPA has made 

to CDX since proposal 

D. How will EPA provide notice of changes 

to CDX? 

VI. Requirements for Electronic Reporting 

under EPA-Authorized Programs 

A. What is the general regulatory 

approach? 

B. When must authorized state, tribe, or 

local government programs revise or 

modify their programs to allow 

electronic reporting? 

1. The general requirement 

2. Deferred compliance for existing systems 

C. What alternative procedures does EPA 

provide for revising or modifying 

authorized state, tribe, or local 

government programs for electronic 

reporting? 

1. The application 

2. Review for completeness 

3. EPA actions on applications 

4. Revisions or modifications associated 

with existing systems 

5. Public hearings for Part 142 revisions or 

modifications 

6. Re-submissions and amendments 

D. What general requirements must state, 

tribe, and local government electronic 

reporting programs satisfy? 

E. What standards must state, tribe, and 

local government electronic document 

receiving systems satisfy? 

1. Timeliness of data generation 

2. Copy of record 

3. Integrity of the electronic document 

4. Submission knowingly 

5. Opportunity to review and repudiate 

copy of record 

6. Validity of the electronic signature 

7. Binding the signature to the document 

8. Opportunity to review 

9. Understanding the act of signing 

10. The electronic signature or subscriber 

agreement 

11. Acknowledgment of receipt 

12. Determining the identity of the 

individual uniquely entitled to use a 

signature device 

VII. What are the Costs of Today’s Rule? 

A. Summary of proposal analysis 

B. Final rule costs 

C. General changes to methodology and 

assumptions 

VIII. Statutory and Executive Order Reviews 

A. Executive Order 12866 

B. Executive Order 13132 

C. Paperwork Reduction Act 

D. Regulatory Flexibility Act 

E. Unfunded Mandates Reform Act 

F. National Technology Transfer and 

Advancement Act 

G. Executive Order 13045 

H. Executive Order 13175 

I. Executive Order 13211 (Energy Effects) 

J. Congressional Review Act 

I. Overview 

A. Why does the Agency seek to provide 

electronic alternatives to paper-based 

reporting and recordkeeping? 

In the Federal Register of August 31, 

2001 (66 FR 46162), EPA published a 

notice of proposed rulemaking, 

announcing the goal of making 

electronic reporting and electronic 

recordkeeping available under EPA 

regulatory programs. The Agency 

believes that the submission and storage 

of electronic documents in lieu of paper 

documents can: 

• Reduce the cost and burden of data 

transfer and maintenance for all parties 

to the data exchanges; 

• Improve the data and the various 

business processes associated with its 

use in ways that may not be reflected 

directly in cost-reduction, e.g., through 

improvements in data quality, and the 

speed and convenience with which data 

may be transferred and used; and 

• Maintain the level of corporate and 

individual responsibility and 

accountability for electronic reports and 

records that currently exists in the paper 

environment. 

Recent federal policy and law are also 

strong drivers of electronic alternatives 

to traditional reporting and 

recordkeeping. The Government 

Paperwork Elimination Act (GPEA) of 

1998, Title XVII of Public Law 105–277, 

requires the Director of the Office of 

Management and Budget (OMB) to 

ensure that executive agencies provide 

for the option of the electronic 

maintenance, submission, or disclosure 

of information as a substitute for paper 

when practicable, and for the use and 

acceptance of electronic signatures, 

when practicable. See GPEA section 

1704. Given the enormous strides in 

data transfer and management 

technologies, particularly in connection 

with the Internet, replacing paper with 

electronic data transfer now promises 

increased productivity across almost all 

facets of business and government. 

In seeking to make electronic 

alternatives available that were not 

contemplated when most existing EPA 

regulations were written, EPA was 

mindful of the need to maintain our 

ability to carry out our statutory 

environmental and health protection 

mission, in part through ensuring the 

integrity of environmental compliance 

documents. Accordingly, the intended 

59850 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

effect of the proposed regulation was to 

permit and encourage the use of 

electronic technologies in a manner that 

is consistent with EPA’s overall mission 

and that preserves the integrity of the 

Agency’s compliance and enforcement 

activities. 

The Agency believes that it is 

essential to ensure that electronic 

reports can play the same role as their 

paper counterparts in providing 

evidence of what was reported and to 

what identified individuals certified 

with respect to the report. Otherwise, 

electronic reporting places at risk the 

continuing viability of self-monitoring 

and self-reporting that provides the 

framework for compliance under most 

of our environmental programs. The 

purpose of today’s final rule is therefore 

twofold. Today’s rule is intended to 

provide regulated industry, EPA, and 

state, tribe, and local governments with 

electronic reporting alternatives that 

improve the efficiency, the speed, and 

the quality of regulatory reporting. At 

the same time, the rule is intended to 

ensure the legal dependability of 

electronic documents submitted under 

environmental programs. This includes, 

among other things, ensuring that 

individuals will be held as responsible 

and accountable for the electronic 

signatures, which they execute, and for 

the documents to which such signatures 

attest as they currently are in cases of 

documents where they execute 

handwritten signatures. 

B. What does the electronic reporting 

rule do? 

EPA is announcing today the final 

regulatory provisions in a new part 3 of 

Title 40 of the CFR for electronic 

reporting to EPA and under authorized 

state, tribe, and local government 

programs. ‘‘Authorized program’’ is 

shorthand for a federal program that 

EPA has delegated, authorized, or 

approved a state, tribe or local 

government to administer under other 

provisions of title 40 of the CFR, where 

the delegation, authorization, or 

approval has not been withdrawn or 

expired. Section 3.3 of the rule codifies 

this usage in the regulatory text. This 

use of ‘‘authorized’’ does not mean that 

EPA is precluded from an enforcement 

action by a prior enforcement action 

being taken by a state, tribe, or local 

government under its authorized 

program. The final rule incorporates 

changes made after publication of the 

proposed rule that are discussed in 

detail in section IV of this Preamble. 

This rule establishes electronic 

reporting as an acceptable regulatory 

alternative across a broad spectrum of 

EPA programs, and establishes 

requirements to assure that electronic 

documents are as legally dependable as 

their paper counterparts. 

The requirements in Subpart B of the 

rule apply to entities that choose to 

submit electronic documents for direct 

reporting to EPA, including state, tribe, 

and local government facilities that 

choose to submit electronic documents 

to EPA to satisfy requirements that 

apply to them under other provisions of 

title 40 of the CFR. However, the scope 

of this final rule excludes any data 

transfers between EPA and states, tribes, 

or local governments as a part of their 

authorized programs or as a part of 

administrative arrangements between 

states, tribes, or local governments and 

EPA to share data. The requirements in 

Subpart D of the rule provide for 

electronic reporting under authorized 

state, tribe, and local government 

programs and apply to the governmental 

entities administering the authorized 

programs. Under the final rule, states, 

tribes, and local governments have the 

choice of using electronic submission 

rather than paper for reporting under 

their authorized programs. Comments 

on the proposed rule indicated that 

some states and local governments are 

now requiring electronic reporting 

under those programs. Existing 

electronic document receiving systems 

must receive EPA approval in 

accordance with Subpart D in order to 

meet the requirements of part 3. 

This rule does not require that any 

document be submitted electronically, 

and it does not require any state, tribe, 

or local authorized program to receive 

electronic documents. Public access to 

environmental compliance information 

is not affected by today’s action. 

Additionally, the scope of the final 

rule specifically excludes the 

submission of any electronic document 

via magnetic or optical media—for 

example via diskette, compact disk 

(CD), digital video disc (DVD), or tape—

as well as the transmission of 

documents via hard copy facsimile or 

‘‘fax.’’ The exclusion of magnetic or 

optical media submissions from the 

scope of this rule in no way indicates 

EPA’s rejection of these technologies as 

a valid approach to paperless reporting. 

Magnetic and optical media 

submissions fulfill the goal of providing 

alternatives to submission on paper. 

EPA has already successfully 

implemented a paperless reporting 

alternative that utilizes magnetic and 

optical media submissions to fulfill 

many regulatory reporting requirements. 

Such instances include reporting related 

to the hazardous waste, Toxic Release 

Inventory, and pesticide registration 

programs. EPA expects these magnetic 

and optical media approaches to 

paperless reporting to continue, and 

nothing in today’s rule should be 

interpreted to proscribe or discourage 

them. 

For entities that report to EPA directly 

and do so by submitting electronic 

documents, today’s action requires that 

these documents be submitted either to 

the Agency’s centralized electronic 

document receiving system, called the 

‘‘Central Data Exchange’’ (CDX), or to 

alternative systems designated by the 

Administrator as described herein and 

in a separate Federal Register notice. 

Entities that submit electronic 

documents directly to EPA will satisfy 

the requirements in today’s rule by 

successfully submitting their reports to 

one of these systems. While we do not 

intend to codify any of the details of 

how CDX operates or how it is 

constructed, the characteristics of the 

CDX and the submission scenarios are 

described later in this Preamble. In 

addition, the CDX design specifications 

are included as a part of this rulemaking 

docket. 

Many facilities submit documents 

directly to states, tribes, or local 

governments under authorized 

programs. For currently authorized 

programs that receive or wish to begin 

receiving electronic documents in lieu 

of paper, this rule requires EPA 

approval of program revisions or 

modifications that address their 

electronic reporting implementations. 

For programs initially seeking 

authorization, this rule requires EPA 

approval of any electronic reporting 

components of the programs. In both 

cases, EPA approval will be based 

largely on an assessment of the 

program’s ‘‘electronic document 

receiving system’’ that is or will be used 

to implement electronic reporting. For 

this purpose, this rule includes 

performance-based standards that EPA 

will use to determine that an electronic 

document receiving system is 

acceptable. To implement electronic 

reporting under currently authorized 

programs, EPA is creating a streamlined 

procedure that states, tribes, and local 

governments may use to revise or 

modify their authorized programs to 

incorporate electronic reporting. 

Today’s rulemaking also includes 

special provisions for authorized 

programs’ electronic document 

receiving systems that exist at the time 

of publication of this final rule. 

It is worth noting that EPA can 

approve changes to authorized state, 

tribe, or local programs that involve the 

use of CDX to receive data submissions 

from their reporting communities, and 

EPA is exploring opportunities to 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59851 

leverage CDX resources for use by states, 

tribes, and local governments. As 

currently implemented, CDX provides 

the major systems infrastructure 

components necessary to achieve 

electronic reporting consistent with the 

standards in this rule for assessing state, 

tribe, or local government electronic 

document receiving systems. 

Additionally, EPA has set the goal of 

making CDX operations fully consistent 

with the requirements in today’s rule 

within two years. 

While today’s rule establishes 

electronic reporting as a regulatory 

alternative, EPA will make the 

electronic submission alternative 

available for specific reports or other 

documents only as EPA announces its 

readiness to receive them through CDX 

or another designated system. EPA will 

publish announcements in the Federal 

Register as CDX and other systems 

become available for particular 

environmental reports. These elements 

are discussed in more detail in section 

V of this Preamble. 

In a notice published concurrently 

with today’s rule, EPA clarifies the 

status of electronic reporting directly to 

EPA systems that exist as of the rule’s 

publication date. In accordance with 40 

CFR 3.10, EPA is designating for the 

receipt of electronic submissions, all 

EPA electronic document receiving 

systems currently existing and receiving 

electronic reports as of the date of the 

notice. This designation is valid for a 

period of up to two years from the date 

of publication of the notice. During this 

two-year period, entities that report 

directly to EPA may continue to satisfy 

EPA reporting requirements by 

reporting to the same systems as they 

did prior to CROMERR’s publication 

unless EPA publishes a notice that 

announces changes to, or migration 

from, that system. Any existing system 

continuing to receive electronic reports 

at the expiration of this two-year period 

must receive redesignation by the 

Administrator under § 3.10. Notice of 

such redesignation will be published in 

the Federal Register. 

C. What is the status of the proposed 

electronic recordkeeping provisions? 

At this time, EPA is only finalizing 

the provisions for electronic reporting to 

EPA and under authorized programs. 

The August 31, 2001, proposal, 

however, also addressed records that 

EPA or authorized programs require 

entities to maintain under any of the 

environmental programs governed by 

Title 40 of the CFR or related state, tribe, 

and local laws and regulations. For such 

records, EPA proposed specific 

provisions for administering the 

maintenance of electronic records under 

these environmental regulations. EPA 

proposed criteria under which the 

Agency would consider electronic 

records to be trustworthy, reliable, and 

generally equivalent to paper records in 

satisfying regulatory requirements. For 

entities that choose to keep records 

electronically, the proposal would have 

required the adoption of best practices 

for electronic records management. For 

facilities maintaining records to satisfy 

the requirements of authorized 

programs, the proposal would have 

allowed for EPA approval of changes to 

the authorized programs to provide for 

electronic recordkeeping. Under the 

proposal, approval would have been 

based on a determination that the 

authorized program would require best 

practices for electronic records 

management, corresponding to EPA’s 

provisions for electronic records 

maintained to satisfy EPA 

recordkeeping requirements. 

Further, EPA proposed that once the 

rule took effect, any records subject to 

the rule that were maintained to satisfy 

the requirements of EPA programs could 

only be maintained electronically after 

EPA announced in the Federal Register 

that EPA was ready to allow electronic 

records maintenance to satisfy the 

specified recordkeeping requirements. 

Also under the proposal, records 

maintained under an authorized state, 

tribe, or local government program 

could only be maintained electronically 

once EPA had approved the necessary 

changes to the authorized program. 

Based on the comments received on 

the proposed electronic recordkeeping 

provisions, EPA reconsidered its 

approach to electronic recordkeeping 

and is not issuing final recordkeeping 

rules at this time. The Agency is 

conducting additional analysis and 

intends to publish a supplemental 

notice or re-proposal to solicit 

additional comments before a final rule 

on electronic recordkeeping is issued. 

We will be reviewing provisions related 

to the methods used to ensure accuracy, 

accessibility and the ability to detect 

alterations of records stored 

electronically, as well as other possible 

controls for electronic recordkeeping. 

The Agency intends to utilize this 

review to engage states, tribes, local 

governments, and industry in 

meaningful consultation to ensure that 

the EPA has the best available 

information on which to base its 

decisions. In conjunction with these 

consultations—and before issuing any 

notice or re-proposal—EPA will conduct 

additional analysis on the costs and 

benefits of alternative approaches, and 

the technical feasibility of various 

options, with a focus on impacts to 

small businesses. Today’s rule does not 

authorize the conversion of existing 

paper documents retained to comply 

with existing recordkeeping 

requirements under other provisions of 

Title 40 of the CFR to an electronic 

format for record-retention purposes. 

D. How were stakeholders consulted 

during the development of today’s final 

rule? 

This final rule reflects more than ten 

years of interaction with stakeholders 

that included states, tribes, and local 

governments, industry groups, 

environmental non-government 

organizations, national standard setting 

committees, and other federal agencies. 

As detailed in the proposal, many of our 

most significant interactions involved 

electronic reporting pilot projects 

conducted with state agency partners, 

including the States of Pennsylvania, 

New York, Arizona, and several others. 

In May, 1997, work began with 

approximately 35 states on the State 

Electronic Commerce/Electronic Data 

Interchange Steering Committee (SEES) 

convened by the National Governors’

Association (NGA) Center for Best 

Practices (CBP). Also, EPA sponsored a 

series of conferences and meetings, 

beginning in June, 1999, with the 

explicit purpose of seeking stakeholder 

advice before drafting the proposal. 

Reports of these conferences and 

meetings are available in the docket for 

this rulemaking, along with the product 

of the SEES effort, a document entitled, 

‘‘A State Guide for Electronic Reporting 

of Environmental Data,’’ and reports on 

some of the more recent state/EPA 

electronic reporting pilots. 

For the proposal, EPA provided a 6- 

month public comment period, which 

closed on February 27, 2002. During 

that time, we received 184 sets of 

written comments on the proposed rule. 

The commenters represented a broad 

spectrum of interested parties: States, 

local governments, specific businesses, 

trade associations, and other federal 

agencies. Substantive changes to the 

electronic reporting provisions based on 

public comments are discussed in detail 

in section IV of this Preamble. In 

addition, EPA received comments at 

four public meetings held around the 

country and at two meetings with states 

held in Washington, DC. The comments 

and meeting summaries can be found in 

the docket to this rulemaking. Today’s 

final rule reflects many of the comments 

and concerns raised by commenters on 

the proposal. (A complete discussion of 

the options considered by EPA and 

other background information on the 

Agency’s policy on electronic reporting 

59852 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

can be found in the proposed rule.) The 

majority of comments focused on the 

costs and burden of the proposed 

Subpart D electronic recordkeeping 

provisions. EPA’s response to public 

comments to the proposal can be found 

in the rulemaking docket, in the 

Response to Comments document. 

E. What alternatives to today’s final rule 

did EPA consider? 

EPA considered both a more stringent 

and a less stringent alternative to the 

regulatory approach taken in this rule. 

The more stringent alternative is 

reflected in the electronic provisions 

published, August 31, 2001, in the 

Notice of Proposed Rulemaking for 

CROMERR. The proposed version of 

CROMERR was more stringent by virtue 

of setting much more prescriptive, 

detailed requirements that electronic 

document receiving systems would have 

to satisfy. For example: 

• Proposed § 3.2000(d) contained 

very specific requirements for submitter 

identity management that a system 

would have to satisfy, including 

detailed requirements for renewal of 

registration and revocation of 

registration under specified 

circumstances; 

• Proposed § 3.2000(e) contained very 

detailed requirements for the signature/ 

certification scenario that a system 

would have to provide for, specifying 

the exact sequence of steps to be 

followed in electronically signing a 

submission, and requiring such features 

as on-screen, scroll-through 

presentation of the data to be submitted 

for review of the signatory prior to 

signing. 

EPA received significant public 

comment on this approach, both from 

states and from regulated companies, 

and there were at least three closely 

related themes. The first was that such 

prescriptive requirements would greatly 

limit the flexibility of states to 

implement electronic reporting in a 

cost-effective way. The second theme 

was that many of the requirements—

especially those specifying the 

signature/certification scenario—were 

not appropriate to many cases where 

electronic reporting would occur. Third 

and finally, many of these commenters 

expressed skepticism that these very 

detailed requirements represented the 

only possible approach to ensuring the 

legal dependability of electronic 

submissions and signatures. These 

themes are discussed in detail in section 

IV.B of this Preamble. 

EPA also considered a less stringent 

alternative that would have refrained 

from specifying requirements to 

establish the identity of an individual to 

whom a signature device or credential 

(e.g. a PIN, password, or PKI certificate) 

is issued. This less stringent alternative 

would have omitted the provision for 

identity-proofing in the final 

§ 3.2000(b)(5)(vii). In terms of regulatory 

impact, this would be a significant 

reduction in stringency. Most of the 

burden on regulated entities imposed by 

today’s rule is associated with the 

registration process involved in 

obtaining a signature device or 

credential, and any requirement to 

establish the registrant’s identity raises 

the aggregate burden substantially. 

EPA rejected this less stringent 

alternative, because we believe that it 

would seriously undermine the rule’s 

ability to assure the legal dependability 

of electronic submissions. It is a basic 

principle of electronic authentication 

(E-authentication) that individuals being 

authenticated are who they say they are. 

E-authentication depends critically on 

the degree of trust we can place in the 

credential the individual presents, and 

such trust depends heavily on the 

process of establishing the individual’s 

identity (or ‘‘identity-proofing’’) when 

he or she first registers for the 

credential. If the identity-proofing 

process is not sufficiently stringent and 

credible, then it may be uncertain who 

is using the credential in a specific 

instance where it is presented. Where 

the credential is used to create an 

electronic signature, inadequate 

identity-proofing may create uncertainty 

as to who the signatory is, as a result, 

the signature may be rendered 

undependable for any legal purpose. 

Accordingly, EPA believes that, 

notwithstanding the cost, it is necessary 

to specify that identity-proofing be 

conducted. The § 3.2000(b)(5)(vii) 

identity-proofing requirement is 

explained in detail in section VI.E.12 of 

this Preamble. 

II. Background 

A. What has been EPA’s electronic 

reporting policy? 

On September 4, 1996, EPA published 

a document entitled ‘‘Notice of Agency’s 

General Policy for Accepting Filing of 

Environmental Reports via Electronic 

Data Interchange (EDI)’’ (61 FR 46684) 

(hereinafter referred to as ‘the 1996 

Policy’), where ‘‘EDI’’ generally refers to 

the transmission, in a standard syntax, 

of unambiguous information between 

computers of organizations that may be 

completely external to each other. This 

notice announced EPA’s basic policy for 

accepting electronically submitted 

environmental reports, and its scope 

was intended to include any regulatory, 

compliance, or informational 

(voluntary) reporting to EPA via EDI. 

For purposes of the 1996 policy, the 

standard transmission formats used by 

EPA were to be based on the EDI 

standards developed and maintained by 

the American National Standards 

Institute (ANSI) Accredited Standards 

Committee (ASC) X12. By linking our 

approach to the ANSI X12 standards, we 

hoped to take advantage of the robust 

ANSI-based EDI infrastructure already 

in place for commercial transactions, 

including a wide array of commercial 

off-the-shelf (COTS) software packages 

and communications network services, 

and a growing industry community of 

EDI experts available both to EPA and 

to the regulated community. At the time 

EPA was writing this policy, ANSIbased EDI was arguably the dominant 

mode of electronic commerce across 

almost all business sectors, from 

aerospace to wood products, at least in 

the United States. (A complete 

discussion of EPA’s 1996 policy can be 

found in the preamble to the proposed 

rule.) 

With this final rule, EPA is making 

changes to the 1996 policy for three 

primary reasons. First, and most 

important, the technology environment 

has changed substantially since the 

1996 policy was written. Web-based 

electronic commerce and public key 

infrastructure (PKI) are two examples. 

While both were available and in use for 

some purposes in 1996, they had not yet 

achieved the level of acceptance and use 

that they enjoy today. We could not 

have anticipated in 1996 that this 

evolution would occur as rapidly as it 

has. Clearly, these developments require 

that we extend our approach to 

electronic reporting beyond EDI and 

Personal Identification Numbers (PINs). 

In addition, they teach us that it is 

generally unwise to base regulatory 

requirements on the existing 

information technology environment or 

on assumptions about the speed and 

direction of technological evolution. 

Second, we believe that technologyspecific provisions would be very 

complex and unwieldy. The resulting 

regulation would likely place 

unacceptable burdens on regulated 

entities trying to understand and 

comply. 

Third, and finally, an electronic 

reporting architecture that makes a 

centralized EPA or state system the 

platform for such functions as electronic 

signature/certification is now quite 

viable—and quite consistent with the 

standard practices of Web-based 

electronic commerce. Given the state of 

technology six years ago, we could not 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59853 

have considered this approach in the 

1996 policy. 

B. How does today’s final rule change 

EPA’s electronic reporting policy? 

For practical purposes, the most 

important change that today’s rule 

makes is in our technical approach to 

electronic reporting. In contrast to the 

1996 policy, today’s rule does not 

generally specify or limit the range of 

allowable electronic submission 

technologies and formats. Under today’s 

rule, complaint electronic reporting 

approaches can include user-friendly 

‘smart’ electronic forms to be completed 

on-line or downloaded for completion 

off-line at the user’s personal computer, 

as well as data transfers via the Internet 

or secure email in a variety of standard 

and common off-the-shelf, applicationbased formats. Similarly, in terms of 

electronic signature technology, the rule 

allows for a range of approaches, 

including various implementations of 

PINs and passwords, the use of private 

or personal information, digital 

signatures based on PKI certificates, and 

other signature technologies as they 

become viable for our applications. As 

EPA or authorized programs implement 

electronic submission for specific 

reports, the rule allows them to select 

one or more of the available submission 

and signature approaches according to 

their circumstances and the programspecific requirements. 

EPA’s goals are to make this 

electronic reporting alternative as 

simple, attractive and cost-effective as 

possible for reporting entities, while 

ensuring that electronically submitted 

documents are as legally dependable as 

their paper counterparts. We believe 

that today’s rule achieves these goals, 

but—unlike the 1996 policy—without 

requiring specific technologies or setting 

detailed procedural steps for the 

submission of electronic documents. 

Our strategy—as initially set out in the 

August 31, 2001, notice of proposed 

rulemaking, and as finalized today—is 

to impose as few specific requirements 

as possible on reporting entities, and to 

generally keep requirements neutral 

with respect to technology. As a 

consequence, today’s rule enables EPA, 

the states, tribes, and local governments 

to offer regulated companies diverse 

approaches to electronic reporting that 

can be tailored to their technical 

capabilities and to the level of 

automation they wish to achieve. In 

addition, the strategy gives EPA, the 

states, tribes, and local governments the 

flexibility to adapt electronic reporting 

systems to evolving technologies 

without requiring that regulations be 

amended with each technological 

innovation. 

However, this regulatory strategy does 

not mean abandoning any control over 

how electronic documents are 

submitted. In place of specific 

technologies or detailed procedural 

steps, today’s rule requires that 

electronic submissions be made to CDX 

or other designated EPA systems, or to 

state, tribe, or local government systems 

that are determined to satisfy a certain 

specified set of technology-neutral 

performance standards. As a practical 

matter, the use of these systems (e.g., 

CDX or others that meet the specified 

performance standards) will involve 

submission procedures that we believe 

are sufficient to ensure the legal 

dependability of electronic reports so 

that they meet the needs of our 

compliance and enforcement programs. 

In addition, while the specified 

performance standards may be 

technology-neutral, agency electronic 

reporting systems that implement the 

standards will incorporate suites of very 

specific technologies that will further 

determine the process for actual 

electronic submission. Sections V.B and 

V.C of this Preamble describe these 

requirements and the associated 

technologies in some detail for the case 

of reporting directly to EPA via CDX. 

III. Scope of the Electronic Reporting 

Rule 

EPA is today promulgating a new Part 

3 in Title 40 of the CFR. The new Part 

applies to all persons who submit 

reports or other documents to EPA 

under Title 40, and to state, tribe, and 

local programs that administer or seek 

to administer authorized programs 

under Title 40. The new part 3 does not 

address contracts, grants or financial 

management regulations contained in 

Title 48 of the CFR. 

A. Who may submit electronic 

documents? 

Any entity that submits documents 

addressed in this rule (see section III.B., 

below) directly to EPA can submit them 

electronically as soon as EPA announces 

that CDX or a designated alternative 

system is ready to receive these reports. 

(See section V of this Preamble for a 

discussion on requirements for 

electronic reporting to EPA, and section 

V.B for a discussion of the status of 

electronic reporting directly to EPA 

systems that exist as of the rule’s 

publication date.) Under this rule, the 

affected entities may elect to utilize the 

electronic reporting alternative. These 

entities are not required by this final 

rule to report electronically; however, 

they may be required to report 

electronically under other Title 40 

regulations, and nothing in today’s rule 

limits EPA’s ability to require electronic 

reporting under other parts of Title 40. 

In general, entities may submit 

documents electronically as provided 

for under authorized state, tribe, or local 

government programs. Nothing in this 

rule prohibits state, tribe, or local 

governments from requiring electronic 

reporting under applicable state, tribe, 

or local law. 

B. Which documents can be filed 

electronically? 

This rule addresses document 

submissions required by or permitted 

under any EPA or authorized state, 

tribe, or local program governed by 

EPA’s regulations in Title 40 of the CFR. 

Nonetheless, EPA will need time to 

develop the hardware and software 

components required for each 

individual type of document. Similarly, 

states, tribes, and local governments 

will need time to evaluate their 

electronic document receiving systems 

to ensure that they meet the standards 

promulgated in today’s final rule. 

Accordingly, once this rule takes effect, 

specific documents submitted directly 

to EPA that are not already being 

submitted electronically to existing EPA 

systems can only be submitted 

electronically after EPA announces in 

the Federal Register that CDX or an 

alternative system is ready to receive 

those specific documents. (See section 

V.B of this Preamble for a discussion of 

the status of electronic reporting 

directly to EPA systems that exist as of 

the rule’s publication date.) Documents 

may be submitted electronically under 

the provisions of an authorized state, 

tribe, or local program. 

C. How does this final rule implement 

electronic reporting? 

The new 40 CFR part 3 consists of 

four (4) Subparts. Subpart A provides 

that any requirement in Title 40 to 

submit a report directly to EPA can be 

satisfied with an electronic submission 

that meets certain conditions (specified 

in Subpart B) once the Agency 

publishes a notice that electronic 

document submission is available for 

that requirement. Subpart A also 

provides that electronic reporting can be 

made available under EPA-authorized 

state, tribe, or local environmental 

programs. In addition, Subpart A makes 

clear: (1) that electronic document 

submission, while permissible under 

the terms of this rule, is not required by 

any provision of this rule; and (2) that 

this rule confers no right or privilege to 

submit data electronically and does not 

obligate EPA or states, tribes, or local 

59854 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

agencies to accept electronic data. 

Subpart A also contains key definitions 

and discusses compliance and 

enforcement. 

Subpart B sets forth the general 

requirements for acceptable electronic 

documents submitted to EPA. It 

provides that electronic documents 

must be submitted either to CDX or to 

other EPA designated systems. It also 

includes general requirements for 

electronic signatures. The requirements 

in Subpart B apply to entities that 

submit electronic documents for direct 

reporting to EPA, including states, 

tribes, and local governments that 

submit electronic documents to EPA to 

satisfy requirements that apply to them 

under Title 40 of the CFR. Subpart B 

does not apply to any data transfers 

between EPA and states, tribes, or local 

governments as a part of their 

authorized programs or as a part of 

administrative arrangements between 

states, tribes, or local governments and 

EPA to share data. Additionally, 

Subpart B does not apply to the 

submission of any electronic document 

via magnetic or optical media—for 

example via diskette, compact disk, or 

tape—or to the transmission of 

documents via hard copy facsimile or 

‘‘fax.’’

Subpart C is reserved for future EPA 

electronic recordkeeping requirements. 

Finally, Subpart D sets forth the 

process and standards for EPA approval 

of changes to authorized state, tribe, and 

local environmental programs to allow 

electronic reporting to satisfy 

requirements under these programs. 

Again, for purposes of Subpart D, 

‘‘electronic reporting’’ entails 

submission via telecommunications, 

and Subpart D requirements do not 

apply in cases of submission via 

magnetic or optical media or hard copy 

‘‘fax.’’ With respect to electronic 

reporting, Subpart D includes simplified 

performance-based standards for 

acceptable state, tribe, or local agency 

electronic document receiving systems 

against which EPA will assess 

authorized program electronic reporting 

elements. It also provides a streamlined 

process for approving applications for 

revisions to authorized programs for 

electronic reporting. 

Given the provisions of Subpart A, a 

regulated entity wishing to determine 

whether electronic reporting directly to 

EPA was available under some specific 

regulation will have to verify that EPA 

has published a Federal Register notice 

announcing their availability and will 

have to locate any additional provisions 

or instructions governing the electronic 

alternative for the particular reporting 

requirement. To facilitate this 

determination, EPA intends to maintain 

an easily accessed list of EPA reports for 

which electronic reporting has been 

implemented—cross-referencing the 

applicable Federal Register notices—on 

the Exchange Network and Grants 

webpage at www.epa.gov/ 

exchangenetwork. 

IV. Major Changes From Proposed 

Electronic Reporting Provisions 

A. How does the rule streamline the 

approval of electronic reporting under 

authorized state, tribe, and local 

government programs? 

1. Review of the proposal. EPA 

proposed that states, tribes, and local 

governmental entities would use the 

procedures for program revision or 

modification provided in existing 

program-specific regulations governing 

state, tribe, or local authorized 

programs. 

In the Preamble to the proposed rule, 

we noted that our approach raised 

certain administrative concerns, 

especially in cases where a 

governmental entity wished to use a 

single system to accept electronic 

submissions across a number of 

authorized programs, corresponding to 

EPA’s use of CDX to receive reports 

across EPA programs. To receive EPA 

approval for such implementations, the 

governmental entity would have to 

apply for revision or modification under 

each authorized program affected, using 

procedures that might vary substantially 

from program to program. While these 

procedures might vary, each substantive 

review would still refer to the same 

proposed part 3 criteria, and—in the 

case of a single system 

implementation—would apply these 

criteria to the same system. EPA 

intended this approach to facilitate an 

administrative streamlining of the 

approval process, by allowing a single 

EPA review of all cross-program 

applications associated with a particular 

electronic document receiving system, 

which would enable EPA to make a 

single decision to approve or disapprove 

all the associated applications. While 

this approach would not eliminate 

multiple applications, it would at least 

simplify the interactions between the 

applicant and EPA during substantive 

review, and would speed EPA action on 

the applications themselves. 

EPA also considered more radical 

streamlining alternatives, including a 

centralized approval process provided 

for by regulation, and the proposal 

requested comment on whether any of 

these alternatives would be preferable to 

the administrative approach to 

streamlining. 

2. Comments on the proposal. In 

comments on the provisions for 

electronic reporting under authorized 

programs, a recurring theme was the 

complexity of the proposed 

requirements for EPA approval of 

program revisions or modifications to 

allow electronic reporting. The 

comments in many cases seemed 

directed equally to the approval process 

and to the proposed criteria for 

approval. Comments on the criteria are 

discussed in more detail in section 

IV.B.2 of this Preamble. 

As for the comments that clearly 

addressed the process, there were two 

major concerns. The first was that the 

process, due to the various current 

program authorization regulations, is 

inherently complicated, timeconsuming and resource-intensive. In a 

few cases, commenters noted the 

particular worry that having to seek EPA 

approval for each program 

implementing electronic reporting 

would be especially burdensome, and 

that EPA’s proposed approach of 

streamlining the internal review 

component of the program revision 

process would be of little help. 

The second concern was the impact of 

the rule on electronic reporting that was 

already underway. Commenters noted 

that many authorized programs are 

already accepting electronic 

submissions, or would be by the time 

the final rule is published, and they 

worried about the timing of the 

requirement that the electronic 

document receiving systems they use for 

this purpose be approved by EPA under 

associated program revision or 

modification procedures. Under the 

proposed provisions, such systems 

would have to be EPA-approved as soon 

as the rule became effective, which was 

not practicable. Given the need to 

address the criteria for approval, such 

applications could only be initiated 

once the rule was finalized, and they 

might take months to complete and get 

approved, or substantially longer in 

cases where the revision or modification 

required state legislative or regulatory 

changes. During the months or years 

that the revision or modification was in 

process, the authorized program would 

either have to shut down their 

electronic document receiving systems 

or, of necessity, operate them out of 

compliance with the rule. Commenters 

were particularly concerned with the 

disruptive impacts of having to shut 

these systems down. They pointed out 

that reversion to paper-based 

submissions in such cases may be 

difficult and expensive, both for the 

agencies and for the submitting entities 

that are affected, and that resuming 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59855 

system operation after a long hiatus may 

require resources more typically 

associated with system start-up. 

Additional comments on program 

revision or modification and EPA’s 

responses can be found in the 

rulemaking docket, in the Response to 

Comments document. 

3. Revisions in the final rule. To 

address the concern that the proposed 

program revision or modification to 

accommodate electronic reporting was 

too complicated and burdensome, the 

final rule provides streamlined 

procedures for adding electronic 

reporting to existing authorized 

programs. These are optional 

procedures that a state, tribe, or local 

government may use if it chooses, in 

place of the applicable program-specific 

procedures, to seek EPA approval for 

revisions or modifications that provide 

for electronic reporting. EPA believes 

that in most cases these optional 

procedures will be substantially simpler 

and quicker than their program-specific 

alternatives. These new procedures are 

discussed in detail in section VI.C of 

this Preamble. 

To address the concern that the 

required program revisions or 

modifications may disrupt authorized 

programs that already have electronic 

reporting underway, the final rule 

provides for a two-year delayed 

compliance date—in effect, a two-year 

‘‘grace period’’—before such programs 

have to submit their applications for 

revision or modification. Programs will 

be allowed this grace period where they 

have systems that fit the definition of 

‘‘existing electronic document receiving 

system,’’ explained in section VI.B.2 of 

this Preamble. In addition, these 

provisions allow the grace period to be 

extended, on a case-by-case basis, where 

an authorized program may need to wait 

for legislative or regulatory changes 

before a complete application can be 

submitted. 

B. How has EPA revised the 

requirements that state, tribe, and local 

government electronic reporting 

programs must satisfy? 

1. Review of the proposal. EPA 

proposed a detailed set of criteria that 

would have to be met by any system 

that is used to receive electronic 

documents submitted to satisfy 

document submission requirements 

under any EPA-authorized state, tribe, 

or local environmental program. The 

proposed criteria addressed the 

capabilities that EPA believed a state, 

tribe, or local government’s electronic 

document receiving system must have 

regarding six function-specific 

categories: (1) System security, (2) 

electronic signature method, (3) 

submitter registration, (4) signature/ 

certification scenario, (5) transaction 

record, and (6) system archives. 

These criteria were based upon EPA’s 

consideration of the roles that many 

electronically submitted documents will 

likely play in environmental program 

management, including compliance 

monitoring and enforcement, and the 

need to ensure that such roles were not 

compromised by the transition from 

paper to electronic submission. In many 

respects electronic submission enhances 

a document’s utility for environmental 

programs: it significantly reduces the 

resources and time involved in making 

the content available to its users, and 

can greatly facilitate data quality 

assurance and analysis. Nonetheless, 

electronic submissions may also be 

open to challenge, primarily with 

respect to their authenticity, and 

particularly where they are used to 

establish the actions and intentions of 

the submitters. We normally consider 

such uses in the case of environmental 

reporting, especially where electronic 

submissions are made to report on an 

entity’s compliance status and where 

the submission includes a responsible 

individual’s certification to the truth of 

what is reported. For such cases, EPA 

identified a programmatic need to be 

able to authenticate the submission 

content and the certification—for 

example, to be able to address issues of 

fraud or false reporting where they 

arise—and it is primarily this need that 

was addressed by the six proposed 

criteria. 

The point of the proposal’s six 

function-specific categories was to 

ensure the authenticity of electronic 

documents submitted in lieu of paper 

reports, so that they will be able to play 

the same role as their paper 

counterparts in providing evidence of 

what was reported and to what an 

identified individual certified with 

respect to the report. For example, in 

the case of paper submissions, the 

evidence surrounding a handwritten 

signature is normally sufficient to 

demonstrate that the signature is 

authentic and rebut any attempt by the 

signatory to repudiate it and EPA 

intends the standards in today’s rule to 

provide evidence for electronic 

signatures that has a corresponding 

level of non-repudiation. Since these 

evidentiary issues typically arise in the 

context of judicial or other legal 

proceedings, electronic documents need 

the same ‘‘legal dependability’’ as their 

paper counterparts. The over-arching 

standard in the concept of ‘‘legal 

dependability’’ is that any electronic 

document that may be used as evidence 

to prosecute an environmental crime or 

to enforce against a civil violation 

should have no less evidentiary value 

than its paper equivalent. For example, 

where there is a question of deliberate 

falsification of compliance data—it must 

be possible to establish the signatory’s 

identity beyond a reasonable doubt no 

matter whether the submission was 

electronic or paper. 

A seventh, more general proposed 

criterion, entitled ‘‘Validity of Data,’’

addressed the standard of legal 

dependability directly. The idea, in 

general, was that a system used to 

receive electronic documents must be 

capable of reliably generating evidence 

for use in private litigation, in civil 

enforcement proceedings, and in 

criminal proceedings in which the 

standard for conviction is proof beyond 

a reasonable doubt that the electronic 

document was actually signed by the 

individual identified as the signatory 

and that the data it contains was not 

submitted in error. The six more 

detailed, function-specific criteria 

represented the requirements for 

satisfying this more general ‘‘Validity of 

Data’’ criterion. Taken together, the 

seven proposed criteria were intended 

to ensure the legal dependability of 

electronically submitted documents by 

providing: 

• Standards for valid electronic 

signatures and authentic electronic 

documents to be admitted as evidence 

in a judicial proceeding; 

• Assurance that electronic 

documents can be authenticated to 

provide evidence of what an individual 

submitted and/or attested to; and 

• Assurance that electronic signatures 

resist repudiation by the signatory. 

By providing for these and other facets 

of an electronic document’s legal 

dependability, proposed CROMERR was 

intended to preserve the ability of EPA 

and its authorized programs to hold 

individuals accountable when they 

certify, attest or agree to the content of 

compliance reports under 

environmental laws and statutes. By the 

same token, proposed CROMERR was 

also intended to ensure that EPA and its 

authorized programs will have the 

documentary evidence they need to 

bring actionable cases of false or 

fraudulent reporting into court. 

2. Comments on the proposed criteria 

for electronic document receiving 

systems. EPA received a substantial 

number of comments on the proposed 

criteria for state, tribe, and local 

electronic document receiving systems, 

both in written submissions and at 

meetings with the public and with state 

and local government officials. While a 

59856 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

few of these comments questioned the 

‘‘Validity of Data’’ criterion, the great 

majority dealt with the detailed 

function-specific criteria. There were at 

least three recurring and closely related 

themes. First, the criteria were too 

prescriptive and inflexible, and would 

prevent state, tribe, and local agencies 

from adapting their electronic reporting 

approaches to their needs and changing 

circumstances, and foreclose new and 

creative ways to achieve legal 

dependability. Second, the criteria 

would make electronic reporting 

unnecessarily complex, costly, and 

burdensome. Third, while the criteria 

might be appropriate for some cases, the 

‘‘one size fits all’’ approach was not 

workable for all reports in all programs. 

Commenters tended to associate these 

three themes with certain 

misperceptions about the proposed 

requirements for signature method and 

the signature/certification scenario. 

Concerning signature method, a 

common concern was that the criteria 

would require states to implement PKIbased digital signatures. Commenters 

generally appear to have inferred this 

from proposed § 3.2000(c) Electronic 

Signature Method, together with EPA’s 

own choice of PKI for some submissions 

to CDX, as discussed in the Preamble. 

Whatever EPA’s plans for CDX, state, 

tribe, and local government systems do 

not have to conform to the CDX model. 

Implementing a particular system of 

necessity requires the choice of specific 

technologies. To make those choices 

does not imply that these are the only 

possible choices that would satisfy 

whatever requirements the rule places 

on electronic reporting systems. 

Concerning § 3.2000(c), commenters 

tended to focus on paragraph (5) of this 

section, which stated that the signature 

method had to ensure ‘‘that it is 

impossible to modify an electronic 

document without detection once the 

electronic signature has been affixed.’’

EPA did not intend for this provision to 

establish PKI-digital signature as the 

required signature method. Given 

current technology, approaches to 

satisfying the § 3.2000(c)(5) requirement 

frequently involve the computation of a 

number—called a ‘‘hash’’—that has a 

unique relation to the content of the 

electronic document such that any 

change to the document content would 

change the computed hash. Given the 

hash, the associated document can be 

confirmed as unmodified at any time by 

calculating a new hash and showing 

that the new and original hashes are 

identical. Using such a hash-based 

approach, it is important to ensure that 

the hash has been secured from 

tampering, and encryption is probably 

the most straightforward way to do this. 

Encryption can be accomplished in a 

number of ways. Approaches include 

PKI-based digital signature, digital 

signature where the asymmetric keypair is not associated with a PKI 

certificate, and various forms of 

symmetric-key cryptography. 

Additionally, it may be possible to 

avoid cryptography altogether by storing 

the hash value in a system with 

appropriately controlled access. Thus, a 

solution using PKI-based digital 

signatures represents only one among a 

number of possible approaches to 

satisfying the proposed §3.2000(c)(5) 

requirement. 

A number of commenters also 

misinterpreted the criteria under 

proposed § 3.2000(e) Electronic 

signature/certification scenario 

(especially the provisions for signatory’s 

review of data under § 3.2000(e)(1)(i)) as 

requiring signatories to scroll through 

their submissions on-screen before they 

affix their electronic signatures, and 

requiring state systems to enforce this 

required ‘‘scroll-through’’. However, the 

proposal provided not that the signatory 

must review the data on-screen, but 

rather that he or she be given the 

opportunity to do so. The example of 

the enforced on-screen ‘‘scroll-through’’

then envisioned for CDX, and provided 

in the CDX section of the proposal’s 

preamble, was in error. EPA did not 

intend to require this ‘‘scroll-through’’

of submitted data prior to signature. 

EPA certainly does expect and 

encourage reporting entities to review 

data intended for electronic submission 

prior to signature, but does not mandate 

this or any other particular mode or 

method of signatory review in today’s 

rule. 

Returning to the three comment 

themes—of prescriptiveness, cost and 

burden, and a ‘‘one size fits all’’

approach—commenters who raised the 

prescriptiveness issue generally argued 

that, even supposing that there were no 

specific objections to the detailed 

§ 3.2000 provisions, EPA had failed to 

make the case that every single 

requirement under these provisions is 

necessary to ensure the legal 

dependability of electronic submissions. 

Commenters who argued that the 

proposed rule would be too costly and 

burdensome generally focused on 

§ 3.2000(c)(5) and § 3.2000(e)(1)(i), 

discussed above, or on the proposed 

§ 3.2000(d) registration and signature 

agreement provisions. There were many 

comments to the effect that the complex 

§ 3.2000(d) registration and reregistration requirements would pose 

substantial barriers to regulated 

company participation in electronic 

reporting and involve unacceptable 

expenses for implementing agencies. 

Commenters also noted that the 

required § 3.2000(e)(1)(i) would be 

difficult to integrate with company 

workflow practices in many cases. 

Finally, there is the ‘‘one size fits all’’

issue. Some of the comments raised this 

as another version of the 

‘‘prescriptiveness’’ issue, but adding 

that the proposal developed just one 

model of electronic reporting and 

attempted to make it fit the differing 

circumstances of the various state, tribe, 

and local agencies that would have to 

comply. Other comments emphasize the 

point that the proposal takes 

requirements apparently tailored to 

assuring an electronic document’s 

authenticity and applies them to all 

cases of electronic reporting, whether or 

not the question of authenticity is likely 

to arise. 

EPA has considered these and related 

comments in writing today’s rule. We 

do not wish to set overly prescriptive 

requirements and so foreclose 

acceptable electronic reporting 

alternatives that could offer equivalent 

or better assurance of legal 

dependability while, perhaps, being 

easier for a state, tribe, or local agency 

to implement. We do not wish to set 

requirements that impose unnecessary 

costs or burdens. And, while we do not 

see a ‘‘bright line’’ around the universe 

of cases where document authenticity 

might be of concern, we also do not 

wish to address authenticity with 

requirements that leave states, tribes, 

and local governments with too little 

flexibility in how they may adapt their 

electronic reporting implementations to 

their particular circumstances. 

Accordingly, EPA has decided to 

finalize criteria for electronic document 

receiving systems that directly articulate 

the underlying goal of assuring the legal 

dependability of electronic documents 

authenticity, and to add more specific 

requirements only to the extent that 

they are needed to achieve this 

underlying goal. Accordingly, the 

provisions of today’s rule have been 

clarified as general performance 

standards necessary to ensure the legal 

dependability of the electronic 

documents they receive. Additional 

comments on the proposed criteria and 

EPA’s responses can be found in the 

rulemaking docket, in the Response to 

Comments document. 

3. Revisions to the criteria in the final 

rule. In today’s final rule, we intend to 

fulfill the underlying goal of the 

proposed § 3.2000 criteria for electronic 

document receiving systems. This is to 

assure the authenticity and nonVerDate Aug<31>2005 16:26 Oct 12, 2005 Jkt 208001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\13OCR3.SGM 13OCR3
Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59857 

repudiation of electronic documents 

submitted in lieu of paper reports, so 

that they are as legally dependable—that 

is, as admissible in evidence and 

accorded the same evidentiary weight—

as their paper counterparts. As noted 

earlier, this goal was expressed most 

directly in the proposed § 3.2000(b) 

‘‘Validity of Data’’ criterion. 

Accordingly, for the final rule, we 

started with the proposed § 3.2000(b) 

and then clarified the remaining 

proposed § 3.2000 criteria as general 

performance standards for electronic 

document receiving systems, which 

were incorporated as needed to assure 

the legal dependability of the electronic 

documents such systems receive. The 

resulting § 3.2000(b) in the final 

electronic reporting rule reflects the 

requirements discussed in the table 

below. The citation for the 

corresponding language in the proposed 

rulemaking is also provided. 

Citation/subject area in proposed rule Citation/requirement in final section 3.2000(b) 

Proposed § 3.2000(g), addressing system archives ................................ Section 3.2000(b)’s leading clause requires that the system be able to 

generate the required data as needed and in a timely manner. 

Proposed §§ 3.2000(e)(3) and 3.2000(f), addressing signature/certification scenarios and transaction record.Section 3.2000(b)’s leading clause and § 3.2000(b)(4) require that the 

system be able to generate a ‘‘copy of record’’ that is made available 

to the submitters and/or signatories for review and repudiation. 

Proposed §§ 3.2000(c) and 3.2000(d), addressing the electronic signature method and submitter registration process.Section 3.2000(b)(5)(i) requires that the system be able to show that 

any electronic signature on an electronic document was created by 

an authorized signatory with a device that the identified signatory 

was uniquely entitled and able to use. 

Proposed § 3.2000(c)(5), addressing requirement that it be impossible 

to modify an electronic document without detection once it has been 

electronically signed.

Section 3.2000(b)(5)(ii) requires that the system be able to show that 

the electronic document cannot be altered without detection once it 

has been electronically signed. 

Proposed § 3.2000(e), addressing the signature/certification scenario ... Sections 3.2000(b)(5)(iii)—(iv) require that the system be able to show 

that, before signing, any signatory had the opportunity to review what 

he or she was certifying to in a human-readable format, and to review the certification statement including any provisions relating to 

criminal penalties for false certification. 

Proposed § 3.2000(d), addressing the submitter registration process .... Section 3.2000(b)(5)(v) requires that the system be able to show that 

the signatory signed an ‘‘electronic signature agreement’’ or a ‘‘subscriber agreement’’ acknowledging his or her obligations connected 

with preventing the compromise of the signature device. 

Proposed § 3.2000(e)(2), addressing acknowledgment ........................... Section 3.2000(b)(5)(vi) requires that the system be able to show that it 

automatically sent an acknowledgment of any electronic submission 

it received that bears an electronic signature; the acknowledgment 

must identify the electronic document, the signatory and the date 

and time of receipt, and be sent to an address that does not share 

the access controls of the account used to make the submission. 

Proposed § 3.2000(d)(1)–(3), addressing submitter registration. ............. Section 3.2000(b)(5)(vii) requires, for each electronic signature device 

used create an electronic signature on documents that the system 

receives, that the system be able to establish the identity of the individual uniquely entitled to use that device and his or her relation to 

the entity on whose behalf he or she signs the documents. 

The requirements in 

§ 3.2000(b)(5)(iii)–(iv) of today’s rule, 

concerning ‘‘opportunity to review,’’ do 

not place the responsibility for 

providing an opportunity, or for 

showing whether or not an opportunity 

was actually taken, on the state, tribe, or 

local government electronic document 

receiving system. What is required is 

that the system provide evidence 

sufficient to show that an opportunity 

was provided; this point is explained in 

greater detail in sections VI.E.8 and 

VI.E.9 of this Preamble. 

EPA believes that the standards in 

§ 3.2000(b) of today’s rule, as developed 

from the proposed ‘‘Validity of Data’’

criterion, together with other proposed 

criteria clarified as general performance 

standards, represent the minimum set of 

requirements for electronic document 

receiving systems necessary to ensure 

the legal dependability of the electronic 

documents such systems receive. For 

example, the requirement for a copy of 

record is necessary to ensure that there 

is an authoritative answer to the 

question of what information content a 

signatory was certifying to or attesting 

to. The related requirement that the 

system be able to provide timely access 

to copies of record and related data 

reflects a practical concern that the data 

be accessible in time and in a format to 

serve the purposes for which it is 

needed. 

Concerning the requirement that 

signature devices be uniquely assigned 

to, and held by individuals, EPA 

believes that an acceptable electronic 

document receiving system must be able 

to attribute a signature to a specific 

individual, to help assure that the 

signatory cannot repudiate 

responsibility for the signature. Nonrepudiation is also strengthened by the 

signed electronic signature agreement, 

which establishes that the signatory was 

informed of his or her obligation to keep 

the signature device from compromise 

by ensuring that it is not made available 

to anyone else. Requiring the signature 

agreement, as well as the opportunity to 

review what they are signing, helps 

establish that where signatures appear 

on electronic documents, the signatories 

had the requisite intent to certify. That 

is, these requirements help ensure that 

the signatories knew what they were 

signing, knew what signing meant, and 

understood the legal implications of 

false certification. As for the 

requirement that document content 

cannot be altered without detection after 

signature, an acceptable electronic 

document receiving system must 

provide evidence sufficient to allow a 

court to attribute the intention to certify 

to the document’s current content to the 

signatory, so that he or she cannot 

repudiate this content. 

Finally, today’s § 3.2000(b)(5)(vii) 

requirement that the system be able to 

establish the identity of the individual 

who is assigned a signature is based on 

proposed § 3.2000(d). Proposed 

§ 3.2000(d) logically entails today’s 

§ 3.2000(b)(5)(vii), because satisfying the 

59858 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

provisions of the former guarantees 

compliance with the latter. However, 

today’s § 3.2000(b)(5)(vii) limits the 

scope of the proposed § 3.2000(d)(3) 

requirement that, in registering for their 

signature devices, registrants must 

execute their electronic signature 

agreements on paper with handwritten 

signatures. In today’s § 3.2000(b)(5)(vii), 

this requirement is limited to a special 

class of ‘‘priority report’’ submittals. 

(See section VI.E.12 of this Preamble.) In 

addition, today’s § 3.2000(b)(5)(vii) 

offers alternatives to this handwritten 

signature requirement, to allow 

electronic reporting solutions that are 

completely free of paper transactions. 

The alternative provisions, found in 

today’s § 3.2000(b)(5)(vii)(A)–(B), are 

elaborations of the proposed 

§ 3.2000(d)(1) requirement for ‘‘evidence 

[of identity] that can be verified by 

information sources that are 

independent of the registrant and the 

entity or entities’’ for which the 

registrant will submit electronic 

documents. The elaborations are 

necessary to assure that individuals’

identities can be established without 

being able to rely on their handwritten 

signatures—and, in the final rule, the 

requirements apply only to ‘‘priority 

report’’ submittals, and only where the 

choice is made to not use paper in the 

execution of electronic signature 

agreements. Section VI.E.12 of this 

Preamble outlines all of today’s 

§ 3.2000(b)(5)(vii) provisions in much 

more detail. In any event, we have made 

these changes to the proposed 

§ 3.2000(d) approach to help address 

commenters’ concerns with ‘‘one size 

fits all’’ provisions, as well as to allow 

states, tribes, and local government as 

much flexibility as possible as they 

implement their electronic reporting 

systems. 

In sum, the overall approach to the 

standards for electronic document 

receiving systems in today’s rule reflects 

a balancing of the concerns raised by the 

public comments, especially those 

relating to the proposal’s burden on 

states, tribes, local governments and 

regulated entities, against the need to 

ensure the legal dependability of 

electronic documents submitted under 

authorized programs. Finally, EPA notes 

that to date the Agency has had limited 

experience with the practical 

application of electronic signatures and 

electronic reporting generally. With the 

benefit of practical experience accepting 

electronic reports under this rule, EPA 

may determine that this rule needs to be 

revisited, to either add or eliminate 

certain safeguards. In addition, while 

EPA has sought to write this rule so that 

its provisions are technology-neutral, it 

remains possible that revisions will be 

required to reflect technological changes 

or changes in prevailing industry norms 

and practices. If these or other 

circumstances require it, EPA thus 

reserves the right to revisit the issues 

addressed in this rule. 

C. How has EPA accommodated 

electronic submissions with follow-on 

paper certifications? 

Currently there are EPA and state 

programs that take electronic 

submissions where the requirements for 

a signed certification statement are met 

with a follow-on paper submission with 

handwritten signatures. A number of 

commenters suggested that such an 

approach be recognized and allowed to 

continue under the electronic reporting 

rule. EPA has no wish to proscribe such 

an approach, and does not judge 

whether or not follow-on paper 

signature/certification is to be preferred 

to the approach where the signature/ 

certification is electronic. To make this 

clear in the final rule, we have added a 

clause to § 3.10(b) that allows follow-on 

handwritten signatures to substitute for 

electronic signatures on submissions to 

EPA where ‘‘EPA announces special 

provisions’’ for this purpose. A 

corresponding clause in § 3.2000(a)(2) of 

today’s rule makes a similar allowance 

for electronic reporting under 

authorized state, tribe, or local 

programs, again, where ‘‘the program 

makes special provisions to accept a 

handwritten signature on a separate 

paper submission.’’

Among other things, these ‘‘special 

provisions’’ would allow follow-on 

paper signature submission only if it 

were reliably linked or cross-referenced 

with the associated electronic 

document. The linking or crossreferencing is necessary in part to 

ensure that we can always determine 

which signature submissions belong 

with which electronic documents. Paper 

signature submissions must also provide 

sufficient evidence that the signatory 

intended to certify to or attest to the 

content of the electronic document as 

this content is recorded in the copy of 

record for the submission. There are 

various approaches to cross-referencing 

or linking that would meet these needs, 

most of which involve the inclusion of 

extra data elements in the signature 

submission that reference the associated 

electronic document. Such data 

elements might include summary data 

from the electronic document, the date 

and time of the electronic submission, 

or even the calculated hash value of the 

electronic document. EPA may use 

these and other alternatives if a decision 

is made to provide for direct electronic 

reporting to EPA with follow-on paper 

signatures. For such submissions to 

authorized programs, we have added to 

§ 3.2000(a)(2) of today’s rule the 

requirement that authorized program 

provisions for follow-on paper signature 

submissions ‘‘ensure that the paper 

submission contains references to the 

electronic document sufficient for legal 

certainty that the signature was 

executed with the intention to certify to, 

attest to, or agree to the content of that 

electronic document.’’

D. How has EPA changed proposed 

definitions of terms? 

The ‘‘Definitions’’ section of the final 

rule, § 3.3, provides new definitions for 

‘‘copy of record,’’ ‘‘electronic signature 

agreement,’’ and ‘‘valid electronic 

signature,’’ as well as the revisions to 

the definition for ‘‘electronic signature 

device,’’ to help articulate the final 

§ 3.2000(b) standards for electronic 

document receiving systems. These 

terms are explained in more detail in 

section VI, below. (See especially, 

sections VI.E.2., VI.E.10. and VI.E.6.) 

Similarly, in section VI.B.2 of this 

Preamble we note the role of the new 

definition for ‘‘existing electronic 

document receiving system;’’ and, in 

section VI.E.12 we discuss the new 

definitions for ‘‘agreement collection 

certification,’’ ‘‘disinterested 

individual,’’ ‘‘information or objects of 

independent origin,’’ ‘‘local registration 

authority,’’ ‘‘priority reports,’’ and 

‘‘subscriber agreement.’’ Section 3.3 also 

reflects a number of clarifying and/or 

simplifying changes for definitions of 

terms, as follows. 

1. Definition of ‘‘acknowledgment.’’

This definition has been added in 

conjunction with § 3.2000(b)(5)(vi) of 

today’s rule, to make clear that in the 

context of this rule, acknowledgment 

means a confirmation of electronic 

document receipt. 

2. Definition of ‘‘electronic 

document.’’ This definition has been 

revised from the proposed version in 

several ways. First, the use of 

‘‘communicate’’ has been eliminated, 

thereby eliminating the need for a 

separate definition of that term. Second, 

the exclusion of magnetic and optical 

media and facsimile submissions has 

been eliminated. We believe it is clearer 

to exclude such submissions from the 

scope of CROMERR under § 3.1, entitled 

‘‘Who does this part apply to?’’ Today’s 

rule now provides this exclusion in 

§§ 3.1(b) and 3.1(c). Third, the 

definition has also been revised so that 

it explains what a ‘‘document’’ is in an 

electronic medium. Instead of saying 

that an ‘‘electronic document means a 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59859 

document. * * *,’’ the final version 

says that ‘‘electronic document means 

any information in digital form. * * *,’’

where information is explained as 

potentially including ‘‘data, text, 

sounds, codes, computer programs, 

software or databases.’’ Fourth, this 

definition clarifies that in this context, 

‘‘data,’’ is used in its normal sense as 

denoting a delimited set of data 

elements, each of which is a unit of 

meaning in a document and consists of 

a content or value together with an 

understanding of what the meaning 

and/or context of the content or value is. 

Finally, the definition stipulates that 

where an electronic document includes 

data, the understanding of what the data 

content or value means must either be 

explicitly included in the electronic 

document or be readily available 

through such sources as an applicable 

data element dictionary, or a form or 

template that specifies what each data 

element means when it is presented in 

the specific file format used for the 

electronic document’s submission. 

A consequence of this approach is 

that the identity of an electronic 

document consisting wholly of data is 

independent of the format in which it is 

presented or submitted. That is to say, 

rearranging or reformatting the data 

elements in an electronic document 

does not change it into a different one, 

at least so long as the signatory’s 

intention and understanding of what the 

data elements each mean is preserved in 

the process. This does not conflict with 

the ordinary understanding of the term 

‘‘document,’’ since we speak quite often 

of ‘‘reformatting a document,’’ with the 

clear understanding that what results 

will be the same document in a new 

format. Correspondingly, under the 

definition of ‘‘copy of record,’’ a ‘‘true 

and correct’’ copy of an electronic 

document does not necessarily have to 

reflect the format in which the 

document was submitted, provided that 

the document consists wholly of data. 

This independence of document 

identity from format may not always 

hold where other kinds of information 

are included in the electronic 

document, e.g. text or images; in such 

cases a copy of record may have to 

include format or formatting 

information. 

3. Definition of ‘‘electronic signature.’’

This definition has been revised by 

substituting ‘‘information in digital 

form’’ for ‘‘electronic record,’’ to avoid 

problems with defining ‘‘electronic 

record.’’ The definition has also been 

revised to make clear that the electronic 

signature for an electronic document 

need not always be ‘‘included’’ within 

that document; in some cases it may just 

be ‘‘logically associated’’ with it. This 

point is explained further in section 

VI.E.2 of this Preamble, in discussing 

the copy of record requirement. 

4. Definition of ‘‘electronic signature 

device.’’ The definition of ‘‘electronic 

signature device’’ has been revised to 

clarify that where a device is used to 

create an individual’s electronic 

signature, then the device must be 

unique to that individual, and he or she 

must be uniquely entitled to use it at the 

time that the signature is created. 

Correspondingly, the device is 

compromised if it is available for use by 

any other individual, that is, if some 

other individual is able to use the 

device to create signatures if he or she 

wishes. To the extent that §§ 3.10(b) and 

3.2000(b)(5)(i) of the final rule prohibit 

the acceptance of signatures created 

with compromised devices, via the 

definition of ‘‘valid electronic 

signature,’’ the element of compromise 

rules out the sharing of electronic 

signature devices or delegating their use 

to create individuals’ electronic 

signatures. Additionally, the definition 

includes the element that an individual 

needs to be entitled to use the electronic 

signature device; that is, the individual 

needs to be the ‘‘owner’’ of the device. 

The nature of the device itself will 

determine the way in which an 

individual comes to own it. In the case 

of personal identification numbers or 

certificate-based private/public key 

pairs, there is normally some process of 

formally assigning the device to the 

individual, often through a trusted third 

party. In other cases, for example 

password or personal information-based 

signature devices, the process may have 

the individuals invent and assign the 

devices to themselves ‘‘ the basis for 

their ownership of the devices being 

determined by the circumstances or 

context within which they do this. 

5. Definition of ‘‘transmit.’’ In the 

proposed rulemaking the term ‘‘submit’’

was defined as the ‘‘means to 

successfully and accurately convey an 

electronic document so that it is 

received by the intended recipient in a 

format that can be processed by the 

electronic document receiving system.’’

However, the term ‘‘submit’’ is used 

more widely in the rule in ways that are 

not consistent with this definition. 

Accordingly, in the final rule the 

function of successful and accurate 

conveyance of an electronic document 

is now termed ‘‘transmit.’’

6. Definition of ‘‘valid electronic 

signature.’’ Beyond its role in 

§ 3.2000(b), this definition has also been 

added to help clarify and simplify the 

signature requirements associated with 

electronic reporting, both directly to 

EPA, in § 3.10, and under authorized 

programs, in § 3.2000(a)(2). The 

definition specifies three main 

conditions for validity. The first refers 

to features of the signature that are 

intrinsic to the items of information of 

which it consists: The signature must 

consist of the kind of information that 

has been established as appropriate for 

the signing of the document in question, 

and the specific information content 

must pass the validation tests which the 

system uses to determine that the 

signature belongs uniquely to the 

identified signatory. The second 

condition refers to the status of the 

electronic signature device used to 

create the signature, and ensuring that 

the device was not compromised at the 

time it was used to create the signature. 

This ties validity to the element of 

compromise within the definition of 

‘‘electronic signature device.’’ That is, at 

the time of signature, the device must 

not have been made available to 

someone other than the individual who 

is entitled to use it. The third condition 

refers to the signatory’s status at the 

time of signature as someone who is 

authorized to sign the document in 

question by virtue of his or her legal 

status and/or relationship to the entity 

on whose behalf the signature is 

executed. In the context of 

environmental reporting, this condition 

would make invalid electronic 

signatures on company compliance 

reports created by individuals who do 

not work for or in any way represent the 

company. Generally, in the context of 

environmental reporting, individuals 

who sign submissions to environmental 

agencies are explicitly authorized to do 

so, by their management and/or by the 

agency to which they report. However, 

in some cases the authorization may be 

implicit in the signatory’s legal status 

and relationship to the regulated entity. 

For example, an owner or operator of a 

company is generally authorized to sign 

notifications or letters to an 

environmental agency whether or not 

this is explicitly provided for by law or 

regulation. 

As ‘‘valid electronic signature’’ is 

used in §§ 3.10 and 3.2000(a)(2), the 

validity of an electronic signature is 

necessary for the signatory’s electronic 

submission to satisfy a federal or 

authorized program reporting 

requirement. Additionally, as the term 

is used in § 3.2000(b), it also refers to a 

performance requirement for an 

electronic document receiving system, 

namely that the system must not accept 

and must be able to detect submissions 

with signatures that are not valid. These 

requirements in terms of ‘‘validity’’ are 

59860 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

meant to provide a form of insurance for 

electronic signatures to protect against 

the risks of repudiation. Nonetheless, a 

signatory may be legally bound by a 

signature even where not all the 

requirements for its validity have been 

met, e.g., where the signature has been 

executed with a compromised electronic 

signature device. The signatory of an 

electronic submission cannot avoid 

responsibility for its contents by 

pointing to a technical flaw or other 

defect in the signature process. 

V. Requirements for Direct Electronic 

Reporting to EPA 

A. What are the requirements for 

electronic reporting to EPA? 

Under the final rule, the requirements 

for electronic reporting to EPA remain 

essentially unchanged from those in the 

proposal. Section 3.10 provides, first, 

that electronic documents must be 

submitted to an appropriate EPA 

electronic document receiving system. 

Generally this will be EPA’s Central 

Data Exchange (CDX), although EPA can 

also designate additional systems for the 

receipt of electronic documents and is 

doing so in a separate Federal Register 

notice. Second, where a paper 

document must bear a signature under 

existing regulations, an electronic 

document that substitutes for the paper 

document must be signed (by the person 

authorized to sign under the current 

applicable provision) with a valid 

electronic signature. 

Only electronic submissions that meet 

these two requirements will be 

recognized as satisfying a federal 

environmental reporting requirement, 

although failure to satisfy these 

requirements will not preclude EPA 

from bringing an enforcement action 

based on the submission or otherwise 

relying on the submission. A new 

compliance and enforcement section 

has been added to the final rule to 

clarify certain compliance and 

enforcement issues related to electronic 

reporting. Section 3.4 makes clear that 

EPA can seek and obtain any 

appropriate federal civil or criminal 

penalties or other remedies for failure to 

comply with an EPA reporting 

requirement if a person submits an 

electronic document to EPA under this 

rule that fails to comply with the 

provisions of § 3.10. Similarly, § 3.4 

makes clear that EPA can seek and 

obtain any appropriate federal civil or 

criminal penalties or other remedies for 

failure to comply with a state, tribe, or 

local government reporting requirement 

if a person submits an electronic 

document to a state, tribe, or local 

government under an authorized 

program and fails to comply with the 

applicable provisions for electronic 

reporting. Section 3.4 also contains 

provisions originally published under 

§ 3.10(d) and (e) of the proposal, 

stipulating that the electronic signature 

will make the person who signs the 

document responsible, bound, or 

obligated to the same extent as he or she 

would be signing the corresponding 

paper document by hand. 

The § 3.10 requirement that there be 

an electronic signature applies only 

where a paper document would have to 

bear a signature were it to be submitted, 

either because this is required by a 

statute or regulation, or because a 

signature is required to complete the 

paper form. The rule does not impose 

any new or additional signature 

requirements for documents that are 

submitted in electronic form. In 

addition, as noted in section IV.C of this 

Preamble, § 3.10(b) of today’s rule also 

allows EPA to make special provisions, 

in specific cases, for accepting 

handwritten signatures in follow-on 

paper submissions in lieu of the 

required electronic signatures. In such 

cases, it is critical that the special 

provisions ensure that the electronic 

document cannot be altered without 

detection and is reliably linked to the 

handwritten signature. 

As in the proposal, this final rule does 

not specify any required hardware or 

software. Accordingly, the rule text does 

not include any detail about CDX per se 

or about what will be required of 

regulated entities who wish to use it. 

Nonetheless, as stated in the proposal, 

our goals include the sharing of detail 

on how CDX implements direct 

electronic reporting to EPA. Section 

V.C.4 of this Preamble explains how 

CDX has changed since we described it 

in the proposal, especially in relation to 

the many comments we received on 

CDX-related issues. 

B. What is the status of existing 

electronic reporting to EPA? 

In a notice published concurrently 

with today’s rule, EPA clarifies the 

status of electronic reporting directly to 

EPA systems that exist as of the rule’s 

publication date. In accordance with 40 

CFR 3.10, EPA is designating for the 

receipt of electronic submissions, all 

EPA electronic document receiving 

systems currently existing and receiving 

electronic reports as of the date of this 

notice. This designation is valid for a 

period of up to two years from the date 

of publication of this notice. During this 

two-year period, entities that report 

directly to EPA may continue to satisfy 

EPA reporting requirements by 

reporting to the same systems as they 

did prior to CROMERR’s publication 

unless EPA publishes a notice that 

announces changes to, or migration 

from, that system. Any existing systems 

continuing to receive electronic reports 

at the expiration of this two-year period 

must receive redesignation by the 

Administrator under § 3.10. Notice of 

such redesignation will be published in 

the Federal Register. 

EPA’s goal is that all its systems for 

receiving electronic reports be 

consistent with the CROMERR 

standards for electronic document 

receiving systems, set forth in 

§ 3.2000(b) of today’s rule. EPA 

generally hopes to achieve this 

consistency within a two-year transition 

period for existing EPA systems; 

however, EPA is not bound by the 

§ 3.2000(b) standards of today’s rule or 

the two-year period. This two-year 

period is similar to the two-year 

transition period provided under 

§ 3.1000(a)(3) for systems operated 

under EPA-authorized programs. In a 

number of cases, EPA may work toward 

this goal by migrating existing electronic 

reporting to CDX or to other, new 

CROMERR-consistent systems. As we 

change or migrate existing electronic 

reporting programs to achieve 

consistency with the CROMERR 

standards, we intend to provide 

sufficient advance notice to reporting 

entities so that any new requirements 

can be accommodated without causing 

significant disruption to their electronic 

reporting activities. 

C. What is EPA’s Central Data 

Exchange? 

1. Overview of general goals. The 

proposal described EPA’s ‘‘Central Data 

Exchange’’ as a system to be developed 

and maintained by EPA’s Office of 

Environmental Information (OEI) that 

would serve as EPA’s gateway or 

‘‘portal’’ for receiving documents 

electronically from our reporting 

community. The goal of CDX was to 

augment, and, where appropriate, 

streamline and consolidate EPA’s 

environmental reporting functions by 

offering our reporting community faster, 

easier, and more secure submission 

options through a single venue for 

electronic submission of environmental 

data. As a cornerstone of EPA’s efforts 

to advance electronic government, CDX 

would support the electronic 

submission needs of thousands of 

regulated entities submitting data to 

EPA for certain air, water, waste, and 

toxic substances programs. Ultimately, 

EPA planned to offer, wherever 

practicable, all regulated entities that 

report directly to EPA, an option to file 

their specific environmental documents 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59861 

electronically through CDX. Regulated 

entities that submit reports under an 

authorized program would also be able 

to file their documents through CDX in 

cases where the state, tribe or local 

government that administered the 

program chose to use CDX as a gateway 

for electronic data submissions from its 

reporting community. 

The reporting community using CDX 

would be able to access web ‘‘reporting’’

forms with built-in data quality checks, 

and/or submit standard file formats 

through common, user-friendly 

interfaces that allowed them to 

electronically submit data across vastly 

different environmental programs. Both 

the reporting community and EPA 

would benefit by gaining access to 

environmental reports more quickly and 

with fewer errors, and by avoiding the 

inefficiencies of having to keystroke 

data from paper reports. CDX was also 

being developed to support a newly 

emerging Environmental Information 

Exchange Network (EIEN) that would 

facilitate the electronic exchange of 

environmental data between EPA and 

state, tribe, and local environmental 

agencies. However, in keeping with the 

scope of the proposed rule the 

description of CDX features and 

functions in this section apply only to 

electronic submissions to CDX from 

regulated entities; the description 

doesn’t apply to EIEN exchanges with 

CDX in which states, tribes, or local 

governments participate as a part of 

their authorized programs or as a part of 

administrative arrangements with EPA 

to share data. 

The Concept of Uniformity. The 

proposal also characterized CDX as 

providing an environment that would 

promote a uniformity of technologies 

and processes. By adopting CDX to 

support the electronic reporting needs 

across various EPA programs, EPA 

hoped to avoid the proliferation of 

program-specific electronic reporting 

approaches that could lead to 

duplicative investments in electronic 

document receiving systems and 

possibly conflicting requirements for 

submitters. 

The CDX Functions and Building 

Blocks. As described in the proposed 

rule, CDX was being designed with the 

goal of fully satisfying the criteria that 

the proposal specified for state, tribe, 

and local electronic document receiving 

systems; similarly, EPA would ensure 

that other systems the Administrator 

designated to receive electronic 

submissions satisfied the criteria as 

well. The proposal discussed how CDX 

would implement CROMERR-compliant 

electronic reporting by describing the 

primary CDX functions and the system 

building blocks that would support 

these functions. The functions described 

in the proposal included: (1) Access 

management, (2) data interchange, (3) 

signature/certification management, (4) 

submitter and data authentication, (5) 

transaction logging, (6) copy of record 

provisions and acknowledgment, (7) 

archiving, (8) error checking, (9) 

translation and forwarding, and (10) 

outreach. The proposal then described 

five building blocks that would support 

CDX functions, which were: (1) Digital 

signatures based on PKI, where CDX 

would rely predominately on a third 

party vendor under the General Services 

Administration (GSA) Access 

Certificates for Electronic Services 

(ACES), (2) a process for registering 

users and managing their access to the 

CDX, (3) a client server-architecture, (4) 

EDI standards, as the primary format for 

exchanging environmental data, and (5) 

a consistent user interface for making 

electronic submissions. 

2. Comments on the proposal. EPA 

received more than 100 comments on 

the CDX concept as described in the 

proposal. A number of these comments 

were related to one of four main subject 

areas, as follows. 

Comments on Uniformity of 

Approach. Several comments expressed 

concern about the proposed 

characterization of CDX as promoting 

‘‘uniformity of process and technology’’. 

The phrase was used to highlight the 

benefits of CDX, which included EPA’s 

plans to avoid the costly proliferation of 

redundant systems. However, comments 

pointed out that this ‘‘uniformity’’

implied an inflexible and overly 

prescriptive set of CDX technical and 

security requirements, which would 

discourage CDX use. Such comments 

were similar to those discussed in 

section IV.B.2 of this Preamble, raising 

concerns about the prescriptiveness and 

‘‘one size fits all’’ approach of the 

proposed criteria for electronic 

document receiving systems. 

EPA understands that ‘‘uniformity of 

process and technology’’ could imply 

inflexibility, and this is not generally 

how we intended to develop CDX. In 

fact, CDX is currently using a wide 

range of technologies and processes to 

address CDX’s functions that are 

tailored to individual EPA program 

submission requirements, including the 

technical capabilities of the reporting 

community for the particular program. 

EPA recognizes that, for example, 

permitting, compliance monitoring, and 

the conduct of studies involve 

fundamentally different business 

processes, and that the associated 

submission of electronic documents 

may have to be handled differently in 

each case. In some instances CDX may 

support a more interactive ‘‘workflow’’

environment for submitting data; in 

others, CDX may accept batch 

transmissions of user-formatted files. It 

is also true that the technical 

capabilities of a particular reporting 

community vary considerably, so CDX 

will offer more than one electronic 

submission option in many cases. CDX 

currently provides support for webforms, file, and record-level submissions 

in various formats including flat file and 

XML and EPA plans to continue this 

flexible approach. 

Comments on registration process. 

Comments from regulated entities raised 

concerns about the costs and time 

required to register individuals in each 

company, and EPA’s failure to address 

the increasingly common cases where 

the preparer of an environmental report 

and the certifying official are different 

individuals. 

Because electronic submission is 

being offered as an option to the 

reporting community, EPA recognizes 

the need to design CDX registration to 

be as user-friendly as practicable, in part 

by taking account of the flow of work, 

or ‘‘workflow’’ involved in meeting a 

particular environmental reporting 

requirement. For example, since 

proposal, EPA has developed 

approaches to register both preparers 

and certifying officials for at least two 

reporting programs. Changes to the CDX 

registration process are discussed in 

more detail in section V.C.4. 

Comments on digital signatures based 

on PKI. Comments pointed out that 

reliance on PKI for all cases of 

electronic signature may violate the 

GPEA directive to vary electronic 

signature approaches with the 

circumstances of their use. Several 

comments underlined this concern by 

pointing to PKI’s costs and burdens. The 

comments objected that registering 

through CDX and acquiring digital 

signature certificates would be overly 

complicated, and would require that 

registrants provide private or personal 

information. Some comment also 

expressed concern about the 

incompatibility of a PKI-based approach 

with workflow, given that 

environmental reports were frequently 

prepared by staff and then signed by the 

facility owner, with staff turnover being 

frequent. Another concern was the 

implications of CDX PKI software for 

company system security, for example, 

given the need to download CDX 

software through the company firewall. 

EPA agrees that it should generally 

minimize the complexity and cost of 

electronic signatures or this will deter 

potential users of CDX from submitting 

59862 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

electronic documents. In implementing 

CDX, EPA has revised the initial plan 

for electronic signatures to include nonPKI electronic signatures. Section V.C.4 

discusses how we are changing the 

‘‘digital signature based on PKI building 

block.’’

Comments on EDI Standards. 

Comments expressed both 

encouragement and concern over CDX’s 

prospective implementation of 

standards-based exchange formats for 

data submissions. An exchange format 

is a predefined file structure, including 

data elements and higher level syntax 

that describes how the data extracted 

from a system must be arranged in a file 

for transmission to another system. A 

standards-based format adheres to 

certain widely-accepted industry, 

national, or international file structure 

definitions. Several comments 

expressed concern about the costs of 

configuring their systems to generate a 

CDX-specified standard format; others 

expressed concerns about the costs of 

potential changes to the format once it 

is implemented on their systems. By 

contrast, other comments strongly 

supported requiring standards-based 

formats—even recommending that we 

require such formats by rule for EPA 

and EPA-authorized state, tribe, and 

local electronic document receiving 

systems. 

CDX’s approach to standards-based 

formats has changed considerably since 

the proposal, in large part because of the 

emergence of Internet-based approaches, 

most notably Extensible Mark-up 

Language (XML). These changes are 

discussed in more detail in section 

V.C.4. EPA believes that the use of 

standard formats can be encouraged 

without requiring this by rule. 

Additional comments on CDX and 

EPA’s responses can be found in the 

rulemaking docket, in the Response to 

Comments document. 

3. The aspects of CDX that have not 

changed since proposal. 

General Goals. EPA’s continues its 

efforts to establish CDX as the gateway 

or ‘‘portal’’ for receiving documents 

electronically from the Agency’s 

reporting community. In so doing, 

EPA’s goal—to augment, and where 

appropriate, to streamline and 

consolidate EPA’s environmental 

reporting functions through CDX—

remains unchanged. The functions that 

comprise CDX operations continue to 

remain the same though the range of 

technologies and processes used to 

support these functions has 

considerably broadened. CDX continues 

to implement electronic reporting 

capabilities for EPA’s many 

environmental programs, while 

advancing the efforts of EIEN in 

coordination with state, territorial, 

tribes, and other partners. 

General Approach to Electronic 

Reporting Implementation. In general, 

current instructions for client-side 

access of CDX suggest Internet access 

and a system that uses both Microsoft 

Windows and Microsoft Internet 

Explorer (IE). EPA acknowledges that 

the Government Paperwork Elimination 

Act (GPEA) directs OMB to develop 

procedures for agencies to follow in 

using and accepting electronic 

documents and signatures and these 

procedures ‘‘may not inappropriately 

favor one industry or technology.’’

Consistent with this GPEA directive, 

EPA is committed to considering ways 

to allow other vendors’ technologies to 

access CDX. Accordingly, over the six 

months following the publication of 

today’s rule, EPA intends to assess the 

full range of issues that affect CDX’s 

ability to support multiple platforms 

and browsers. These issues include the 

technical requirements for the electronic 

signature options, form entry options, 

data upload options, network interface 

options, current capabilities of the CDX 

hardware/software platform, and 

potential impacts of new client-side 

platforms on the CDX life cycle 

management, technical support 

requirements, and help desk training 

and support. Based on this assessment, 

EPA intends to determine the target 

universe of client-side platforms and 

browsers that CDX can feasibly 

accommodate, and will identify the 

actions and timeline necessary to build 

out CDX support for this target universe. 

As described in the proposal, CDX 

users will need to: 

• Register with CDX, during which 

time they may need to supply 

information used to identify themselves, 

their company, and the EPA documents 

they wish to submit electronically; 

• Verify and/or correct registration 

information; and 

• Access their CDX web account 

through a secure website, and agree to 

the terms and conditions of using the 

site, which include safeguarding their 

self-generated password, before using 

web forms or uploading files to submit 

electronic documents or data to EPA. 

These are the minimum steps for 

gaining access to CDX at this time. 

Additional steps are involved in 

acquiring an electronic signature device, 

although these steps have changed 

somewhat since the proposal and are 

discussed in section V.C.4. CDX also 

offers at least two general methods for 

reporting electronically for many 

programs it supports, either through file 

submission or through a ‘‘smart web 

form’’. However, the types of formats 

and approaches for submitting data 

through CDX have broadened, and these 

too are discussed in section V.C.4. 

4. The major changes that EPA has 

made to CDX since proposal. Over the 

last two years, CDX has evolved from a 

prototype system to a fully operational 

electronic document receiving system. 

CDX supports tens of thousands of 

registered users providing data to 

dozens of environmental reporting 

programs across the major EPA media 

offices. CDX registered users include 

representatives from state, tribe, and 

local agencies, industries, laboratories, 

and other federal agencies. While CDX 

continues to provide a secure, single 

point of registration, access, and 

exchange between reporting entities and 

EPA programs, the building blocks 

supporting the CDX functions have 

changed substantially. These changes 

reflect EPA’s experience operating CDX 

over the past two years, evolving trends 

in Internet technologies, and comments 

received on the proposed rule from 

potential CDX users. 

Digital signatures based on PKI. The 

proposal described the CDX approach to 

electronic signatures in terms of digital 

signatures and PKI. Since proposal, EPA 

has come to appreciate the complexity 

and costs of implementing PKI, and to 

recognize that non-PKI electronic 

signatures, as described in section 

IV.B.2 of the preamble today’s rule, may 

be acceptable in many cases. Thus, for 

electronic reports currently submitted to 

CDX, only in one case is PKI used for 

electronic signature. The other cases 

involve PIN-based electronic signatures 

or other non-PKI electronic signature 

approaches. As an example of the latter, 

this year we anticipate implementing 

electronic signatures for an EPA 

reporting requirement by having 

signatories use a password that is selfgenerated during CDX registration in 

combination with certain items of 

information that are unlikely to be 

available to anyone except the signatory. 

This is a ‘‘knowledge-based’’ approach, 

which is being used extensively by 

commercial software vendors 

supporting the United States Internal 

Revenue Service (IRS) for electronic tax 

filings or ‘‘e-filings’, and is being 

adopted by other agencies. EPA expects 

that these non-PKI-based approaches to 

signature will continue to dominate 

CDX implementations of electronic 

reporting. We currently intend to use 

PKI where such needs as security or 

assuring very robust non-repudiation of 

signature make this the most 

appropriate approach. 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59863 

In addition, EPA’s approach to PKI 

itself—described in the proposal as 

relying on ACES—is also undergoing 

change. Changes with respect to the role 

and method of identity proofing for 

those persons who apply for PKI 

certificates is being further evaluated. 

As proposed, the identity proofing was 

to be conducted by the third party ACES 

vendor; currently, CDX identity 

proofing is conducted for the most part 

by EPA’s own contractor staff, who are 

able to issue digital certificates to 

members of the reporting community 

with less cost and in less time than the 

ACES vendor. EPA has also begun to 

explore alternatives to ACES for PKI 

certificates, partly because ACESprovided certificates do not support 

message encryption, which EPA may 

need for certain environmental 

reporting applications. In addition, EPA 

is considering its use of ACES in the 

light of recent federal advances in 

establishing interoperability across 

federal PKI domains, which may allow 

EPA to eventually leverage PKI’s of 

other federal agencies or institute an inhouse PKI. 

CDX Registration. Since the proposed 

rule, CDX has broadened it approach to 

registration to better accommodate the 

workflow involved in specific 

environmental reporting programs. 

While CDX still requires registration, 

there are three distinct areas where the 

registration process has changed since 

proposal. First, the proposal described 

CDX registration as the first step toward 

the issuance of a PKI-based digital 

signature, and it was implied that all 

persons opting to use CDX would need 

a digital signature. As noted above, this 

is no longer the case. Second, in the 

proposal, CDX registration began when 

a person received an EPA invitation 

letter that contained a temporary code 

and instructions on how to access the 

CDX registration website. CDX has 

adopted additional approaches to 

initiating registration for certain EPA 

programs, for example, embedding a 

link to CDX registration in reporting 

software that is distributed to the 

program’s reporting community, or 

providing a public website where 

prospective CDX users can submit 

initial registration data EPA. While CDX 

continues to register persons by 

invitation letter for reporting under 

certain environmental programs, 

registration options will continue to 

broaden as the number of environmental 

programs supported by CDX expands. 

Finally, in the proposal, CDX 

registration was completed when the 

registrant printed out a ‘‘signature 

holder’’ agreement from the CDX 

registration website, signed this 

agreement and mailed it to EPA’s CDX. 

CDX will continue this approach for 

reports where electronic signatures are 

required, although EPA is exploring the 

use of an entirely paperless signature 

agreement process for at least some of 

these cases. CDX registration to submit 

reports that do not include electronic 

signatures will not involve a ‘‘signature 

holder’’ agreement. 

EDI Standards. The proposal 

described EPA’s plans to use EDI as the 

basis of standards-based formats for 

exchanging data between reporting 

entities and CDX. Since proposal, CDX 

development has reflected a significant 

evolution in formatting standards to 

accommodate the Internet—away from 

EDI and toward the use of XML. XML 

consists of a set of predefined tags and 

message structures that, like EDI, allows 

machine-to-machine exchange of data in 

a mutually agreed upon format, enabling 

exchange of data across different 

systems. However, unlike EDI, XML is 

tailored to Internet-based 

communications and security protocols. 

Additionally, an XML formatted file in 

combination with a style sheet can be 

displayed in a Web browser. Such 

features would allow CDX to use the 

same standard format both for 

exchanging data files and for designing 

web forms. The structure of XML also 

addresses some of the challenges in 

archiving data received, because the 

XML tags that accompany the data in an 

XML file can be used to interpret the 

data’s context without the aid of 

additional software. This could facilitate 

the recovery of data from archived files, 

and reduces the need to maintain the 

versions of the software originally used 

to generate the files. 

CDX and specific EPA programs may 

address the question of which (if any) 

standards-based format to use for a 

particular report on a case-by-case basis, 

and EPA intends to develop appropriate 

technical instructions for CDX 

submitters as program-specific reporting 

formats are adopted. These instructions 

normally will be distributed to the 

affected reporting communities via links 

on the CDX website and/or through 

program and CDX outreach efforts. EPA 

is working with authorized state, tribe, 

and local programs to develop 

standards-based reporting formats to 

meet their shared needs. In many 

instances, CDX contemplates a long 

transition period between file formats 

currently used to exchange data with 

regulated entities and any new, 

standards-based formats. During this 

transition, CDX may offer submitters 

several electronic submission options; 

these may include an existing data 

format familiar to submitters, one or 

more new standards-based formats, and 

some other approach such as a smartform hosted on a secure website. 

Client-side architecture and 

transaction environment. The proposal 

described a downloaded ‘‘client’’ that 

would generally supplement the 

browser to support the signature and 

security for CDX; such ‘‘client side’’

software is no longer needed for all 

cases of electronic reporting to CDX. 

However, in some cases CDX now uses 

various technologies to transparently 

insert routines into browsers during a 

user session to support special 

functions—for example to support the 

creation of a PKI-based electronic 

signature with an ACES business class 

certificate. 

D. How will EPA provide notice of 

changes to CDX? 

As noted in the proposal, the fullyimplemented CDX will be subject to 

change over time, to take advantage of 

opportunities offered by evolving 

technologies, as well as to improve the 

system. EPA’s decision to avoid 

codifying technology-specific or 

detailed procedural provisions for 

electronic reporting is meant, in part, to 

accommodate changes to CDX without 

requiring that we amend our 

regulations. Nonetheless, EPA 

recognizes that such changes can affect 

regulated entities that participate in 

electronic reporting; therefore, the final 

rule provides for advance notice when 

EPA intends to make changes to CDX. 

As discussed in the proposal, we 

distinguish four categories of changes: 

• ‘‘Significant’’ changes that are likely 

to affect the kinds of hardware, software 

or services involved in transmitting 

electronic reports (§ 3.20(a)(1)); 

• ‘‘Other’’ changes that will affect the 

process or the timing of transmitting 

electronic reports to CDX, but without 

affecting the kinds of hardware, 

software or services involved in making 

the transmissions (§ 3.20(a)(2)); 

• ‘‘Emergency’’ changes necessary to 

protect the security or operational 

integrity of CDX (§ 3.20(b)). 

• ‘‘De minimis or transparent’’

changes that will have minimal or no 

impact on the process or the timing of 

transmitting electronic reports to CDX. 

‘‘Significant’’ changes include changes 

to the types of file formats CDX will 

accept—for example a change from 

extended markup language (XML) 

formats to some non-XML format—as 

well as changes to the technologies that 

may be used for file transfer to CDX or 

for creating electronic signatures on 

transmitted reports. ‘‘Significant’’

changes will not generally include 

optional upgrades to software, the 

59864 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

provision of additional formatting (or 

other technical) options, or changes to 

CDX that simply reflect changes to the 

underlying regulatory reporting 

requirements. ‘‘Other’’ changes include 

an increase in—or re-ordering of—the 

steps involved in transmitting electronic 

reports, changes to the registration or 

credential (e.g., PIN, password, PKI 

certificate) provisioning process that 

could affect users ability to access CDX, 

and changes to reporting formats that 

involve the reconfiguration of software. 

‘‘Emergency’’ changes include such 

things as an upgrade to the system 

firewall protection. Finally, ‘‘de minimis 

or transparent’’ changes include the 

myriad small or ‘‘back end’’ fixes and 

improvements that EPA makes to CDX 

each week that have minimal or no 

impact on the transmission process. 

Such changes may range from fixing a 

typo on a data entry screen to reengineering the system’s archiving 

routines. 

To address ‘‘significant’’ changes, 

§ 3.20(a)(1) of the final rule provides 

that EPA will give public notice in the 

Federal Register of such changes and 

will seek comment. EPA proposed to 

provide this notice at least a year in 

advance of contemplated 

implementation, but based on 

experience developing and operating a 

CDX prototype, EPA no longer believes 

that a single time-frame is appropriate 

in all situations. For example, 

‘‘significant’’ changes that could affect 

the transmission of an annual report 

may respond to needs or events that 

arise less than a year in advance of the 

report’s due date. On the other hand, 

some ‘‘significant’’ changes may require 

more than a year for reporting entities 

to accommodate. Accordingly, the final 

rule provides that these Federal 

Register notices will propose and seek 

public comment on an implementation 

schedule for a ‘‘significant’’ change, 

along with describing and inviting 

comment on the change itself. To 

address ‘‘other’’ changes to CDX, 

§ 3.20(a)(2) of the final rule provides 

that EPA will give notice at least 60 

days in advance of implementation. The 

notice in this case will typically be to 

CDX users, and the method of notice 

may be electronic, perhaps using the 

facilities of CDX itself. For ‘‘emergency’’

and ‘‘de minimis or transparent’’

changes, EPA will make decisions on 

whether, when, and how to provide 

public notice on a case-by-case basis. 

VI. Requirements for Electronic 

Reporting Under EPA-Authorized 

Programs 

A. What is the general regulatory 

approach? 

As explained in Part V of this 

preamble, the requirements in § 3.10 of 

today’s rule apply to reporting entities 

that submit electronic reports directly to 

EPA. By contrast, today’s rule contains 

no requirements that apply directly to 

entities who submit electronic reports to 

state, tribe, or local government 

agencies. However, Subpart D of today’s 

rule does contain requirements that 

apply to state, tribe, or local government 

agencies that operate EPA-authorized 

programs. Subpart D of today’s rule 

requires that such agencies that receive, 

or wish to begin receiving, electronic 

reports under an authorized program 

must apply to EPA for a revision or 

modification of that program and get 

EPA approval. Subpart D provides 

standards for such approvals based on 

consideration of the electronic 

document receiving system that the 

state, tribe, or local government will use 

to implement the electronic reporting. 

Additionally, Subpart D provides for 

special procedures for program 

revisions and modifications that provide 

for electronic reporting, to be used at the 

option of the state, tribe, or local 

government in place of procedures 

available under existing programspecific authorization regulations. 

Generally speaking, EPA believes that 

even absent today’s rule, an authorized 

program’s electronic reporting 

implementation would still need EPA’s 

approval under a program revision or 

modification. At least where electronic 

reports may play a role in enforcement 

proceedings, the authorized program’s 

electronic reporting implementation has 

the potential to affect program 

enforceability, and as such, revises or 

modifies the program. Today’s rule 

makes this explicit in § 3.1000. In 

addition, the final rule includes 

program-specific amendments to 

various provisions in 40 CFR to cross 

reference those rules to the new Part 3. 

With this approach, EPA hopes to 

support and promote state, tribe, and 

local government efforts to make 

electronic reporting available under 

their authorized programs, both by 

clarifying the requirement that EPA 

approve these electronic reporting 

initiatives, and by providing a single, 

uniform set of standards and a speciallydesigned process to facilitate electronic 

reporting approval for otherwise 

authorized programs. 

B. When must authorized state, tribe, or 

local government programs revise or 

modify their programs to allow 

electronic reporting? 

1. The general requirement. As 

discussed earlier, this rule does not 

require states, tribes, or local 

governments to allow or require 

electronic reporting. Where they choose 

to do so, § 3.1000 generally provides 

that they must revise or modify such 

programs to ensure that their electronic 

reporting implementation will meet the 

requirements of section 3.2000. 

Additionally, once these authorized 

programs begin operating the electronic 

reporting systems under EPA-approved 

revisions or modifications, they must 

keep EPA informed of changes to laws, 

policies or the electronic reporting 

systems that could affect the program’s 

compliance with § 3.2000. Where the 

Administrator determines that such 

changes require EPA review and 

approval, EPA may ask the authorized 

program to submit an application for 

revision or modification to address the 

changes. Alternatively, the authorized 

program can apply for a revision or 

modification on its own initiative. 

For any of these program revisions or 

modifications, states, tribes, or local 

governments may use either the 

application procedures provided under 

§ 3.1000(b)–(e) or the program-specific 

procedures provided in other parts of 

Title 40 or the applicable statute. 

Whichever procedure is used, the state, 

tribe, or local government must submit 

an application that complies with the 

requirements of § 3.1000(b)(1), 

discussed in section VI.C.1. Section 

3.1000(b)(1) identifies the elements of 

an electronic reporting program that 

EPA would need to consider in order to 

approve a state’s, tribe’s, or local 

government’s approach to receiving 

electronic documents, in lieu of paper, 

to satisfy requirements under their EPAauthorized programs. 

2. Deferred compliance for existing 

systems. For authorized programs that 

have ‘‘existing’’ electronic document 

receiving systems as of the date this 

final rule is published, EPA is deferring 

the deadline for these programs to 

submit their applications for program 

revisions or modifications with respect 

to such systems. The deferral is 

generally two years from the date of this 

rule’s publication. This approach is 

consistent with similar provisions under 

other regulations governing program 

authorization where new requirements 

are imposed. Additionally, EPA 

conducted extensive discussions with 

entities operating authorized programs 

about how much time they generally 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59865 

would need to bring their systems into 

compliance with today’s rule, given 

their funding cycles, program review 

schedules under ‘‘performance 

partnership’’ agreements, the 

timeframes for making any necessary 

system upgrades and completing an 

application for program revision or 

modification, and any necessary 

legislative or regulatory changes. Based 

upon these discussions, we believe that 

this two-year period is generally 

sufficient to allow these programs to 

make the transition to CROMERRcompliant systems without having to 

discontinue their electronic reporting 

operations. Today’s rule also allows 

authorized programs to request 

extensions to the two-year deadline 

where the timeframe for regulatory or 

legislative changes may be somewhat 

longer. 

EPA’s purpose in deferring the 

application deadline for program 

revisions or modifications with respect 

to existing electronic reporting is to 

avoid disrupting authorized programs’

electronic reporting initiatives that are 

already underway. With this goal in 

mind, EPA has defined ‘‘existing 

electronic document receiving system’’

broadly, to include not only those that 

are actually operational at the time the 

final rule is published, but also those 

that are substantially developed. We 

recognize that it would be disruptive to 

require that authorized programs shut 

down their operational systems during 

the time it would take to prepare, 

submit and have their applications for 

revision or modification approved. 

However, there is often a very fine line 

between an operational system and a 

system under development; for 

example, where the developmental 

work is to scale a working prototype up 

to production. In addition, at least the 

later stages of development are likely to 

be restrained substantially or even 

halted if a system must await EPA 

approval to operate, and this may affect 

system costs, availability of contractor 

staff and their ability to complete the 

system in a timely manner. Avoiding 

such disruptions to substantially 

developed systems is part of the goal of 

the deferred compliance provisions. To 

define what counts as a ‘‘substantially 

developed’’ system for this purpose, the 

definition of ‘‘existing electronic 

document receiving system’’ uses 

evidence that system services or 

specifications are already established by 

existing contracts or other binding 

agreements. Where an agency has 

already made legally binding 

agreements to procure a significant 

proportion of the services and/or 

components that will constitute the 

system then such a system would be 

considered ‘‘existing’’ under this rule. 

While many or most authorized 

programs with existing systems may 

need this two-year compliance deferral, 

some may have no difficulty submitting 

a completed application well before the 

end of two years. We strongly encourage 

such early submissions when feasible. 

This will make better use of EPA’s 

review resources and will provide 

earlier certainty of compliance with this 

rule for existing state, tribe, and local 

government electronic reporting 

programs that are subject to this rule. In 

addition, EPA believes that, whether 

through informal consultation or formal 

application, identifying and addressing 

any existing system issues as early as 

possible is the best way to avoid 

disruption to electronic reporting 

initiatives currently underway. 

C. What alternative procedures does 

EPA provide for revising or modifying 

authorized state, tribe, or local 

government programs for electronic 

reporting? 

Under § 3.1000, this rule provides 

procedures which a state, tribe, or local 

government, at its option, can use to 

seek approval for revisions or 

modifications with respect to electronic 

reporting under its existing authorized 

programs. These optional procedures 

are available both for revisions or 

modifications that seek initial EPA 

approval for electronic reporting 

programs, and also for revisions or 

modifications to accommodate 

substantial changes to electronic 

reporting programs that already have 

EPA approval. 

Although there is always the 

alternative of using the program-specific 

procedures provided in other parts of 40 

CFR, EPA believes that, normally, a 

state, tribe, or local government would 

find the procedures provided in this 

rule to be shorter, simpler, and easier. 

The § 3.1000 procedures allow 

submission of a single, relatively simple 

application to request revisions or 

modifications that address electronic 

reporting across any number of 

authorized programs. Additionally, the 

procedures provide for a single, 

straightforward EPA review process, 

with deadlines for EPA action written 

into the rule. EPA believes that these 

procedures will be especially useful 

where the state, tribe, or local 

government is planning to implement 

all of its program-specific electronic 

reporting with a single system. Rather 

than requiring approval program-byprogram, § 3.1000 allows the system to 

be addressed in a single application 

package that can be reviewed in its 

entirety and responded to within a 

relatively short and predictable timeframe. 

1. The application. To request 

modifications or revisions under this 

rule, § 3.1000(b)(1) requires a state, 

tribe, or local government to submit an 

application that generally contains three 

elements. The first is a certification that 

state, tribe, or local government laws 

and/or regulations provide sufficient 

legal authority to implement electronic 

reporting in conformance with § 3.2000 

and to enforce the affected authorized 

programs using electronic documents 

collected under those programs; the 

application must also include copies of 

the relevant laws and/or regulations. 

This certification of legal authority is 

not meant to address actual 

conformance with § 3.2000(b); that is, 

the certification is not meant to reflect 

a judgment about the capabilities of an 

agency’s electronic document receiving 

system. However, the certification 

would address § 3.2000(c), and must be 

signed by the governmental official who 

is legally competent to certify with 

respect to legal authority on behalf of 

his or her government. In the case of a 

state, this official must be the Attorney 

General or his or her designee. In the 

case of tribes or local governments, this 

official must be the chief executive or 

administrative official or officer or his 

or her designee. EPA realizes that 

obtaining an Attorney General’s 

certification for state applications may 

involve considerable administrative 

burden; however, as a legal matter, EPA 

believes that Attorneys General or their 

designees are the only officials capable 

of certifying with respect to their states’

legal authority. Where there are 

substantial administrative obstacles to 

involving the Attorney General in such 

certifications, EPA urges the state 

Attorney General to provide for a 

legally-competent designee who is 

available to participate in the 

submission of the state’s application. 

The second element of the 

application, and the most substantive, is 

a listing and description of the 

electronic document receiving systems 

that do or will receive the electronic 

submissions addressed by the requested 

program revisions or modifications. The 

application should specify the 

electronic submissions each system will 

be used to receive, and which (if any) 

of these submissions involve electronic 

signatures. In describing each system, 

the application should explain how the 

system will satisfy the applicable 

requirements of § 3.2000. Many of these 

requirements apply only to systems that 

receive submissions with electronic 

59866 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

signatures; accordingly, the descriptions 

for systems that receive no 

electronically signed submissions will 

be relatively short and simple. For each 

of the § 3.2000 requirements that do 

apply, the description should explain 

the functions the system will perform to 

satisfy the requirement, and the 

technologies that will be used to achieve 

this functionality. EPA does not expect 

such explanations to include detailed 

technical specifications of the systems, 

but rather to provide conceptual 

descriptions of the technical approach 

and functionality. In implementing this 

rule, EPA will provide applicants with 

more detailed recommendations for 

preparing these system descriptions, 

including examples and an application 

checklist. 

The third element of the application 

is simply a schedule of upgrades to each 

system addressed by the application—to 

the extent that such upgrades can be 

anticipated—together with a brief 

discussion of how the upgrades will 

assure continued compliance with 

§ 3.2000. This third element should be 

thought of as an appendix to the second, 

recognizing that the functionality with 

which each electronic document 

receiving system addresses the § 3.2000 

requirements normally exists within the 

dynamic environment of the system life 

cycle. 

2. Review for completeness. Once EPA 

receives an application submitted under 

the procedures in this rule, EPA will, 

within 75 calendar days, send a letter 

that either notifies the applicant that its 

application is complete or identifies 

deficiencies that render the application 

incomplete. An applicant that receives a 

notice of deficiencies may amend the 

application and resubmit it. From the 

date EPA receives the amended 

application, EPA will, within 30 

calendar days, respond with a letter that 

either notifies the applicant that the 

amended application is complete or else 

identifies remaining deficiencies. If an 

amended application is not submitted 

within a reasonable time period to 

remedy identified deficiencies, EPA has 

the authority to review and act on the 

incomplete application, as explained in 

section VI.C.3. 

3. EPA actions on applications. EPA 

will act on an application by either 

approving or denying the requested 

program revisions or modifications. In 

the case of a consolidated application 

for revision or modification of more 

than one program, EPA need not take 

the same action on each revision or 

modification; some may be approved 

while others are denied. EPA will have 

180 calendar days from the time it sends 

a notice of completeness to act on an 

application in its entirety. Except in 

certain cases of requested revisions or 

modifications associated with existing 

systems (see section VI.C.4) or with an 

authorized public water system program 

under 40 CFR part 142 (see section 

VI.C.5), if EPA does not act on a 

program revision or modification by the 

end of the 180-day review period, then 

that revision and/or modification is 

considered automatically approved by 

EPA. The rule allows this review period 

to be extended, at the request of the 

state, tribe, or local government 

submitting the application. This may 

accommodate situations where EPA and 

the applicant are working through 

issues that may take more than the 180- 

day review period to resolve, and they 

mutually find it in their best interest to 

continue discussion before EPA makes 

its decision. 

Where EPA approves a program 

revision or modification (by either 

affirmative or automatic approval), the 

approval becomes effective when EPA 

publishes a notice of the approval in the 

Federal Register. Where EPA denies a 

requested revision or modification, EPA 

will explain the reasons for the action 

and advise the applicant of the steps 

that can be taken to remedy the 

application’s defects and will generally 

try to work with the applicant to 

address the issues that have posed an 

obstacle to approval. Additionally, in 

some cases, denial of approval under 

the § 3.1000 process may result from 

EPA’s determination that the 

application raises certain issues that are 

highly program-specific and that these 

cannot be adequately addressed through 

the procedures provided in this rule. 

For example, there may be issues that 

require a discussion of program features 

that the § 3.1000(b)(1) application 

would not cover. In such cases, EPA 

will identify the issues that exceed the 

scope of the § 3.1000 process and will 

advise the applicant to request the 

revision or modification under the 

applicable program-specific procedures 

provided in other parts of Title 40. 

4. Revisions or modifications 

associated with existing systems. Some 

applications will request modification 

or revision to an authorized program 

with an ‘‘existing electronic document 

receiving system’’. As noted in section 

VI.B.2, the deadline for submitting such 

applications is two years after the 

publication of today’s rule. Where such 

applications are submitted and are 

determined to be complete before the 

two-year deadline, EPA will have a 180- 

day review-period for any program 

modification or revision being 

requested, as explained in section 

VI.B.3. However, where EPA sends 

notification that an application is 

complete after the two-year deadline has 

passed, for example, because the 

application was submitted relatively 

late in the two-year period, EPA will 

have 360 days to act on any requested 

modification or revision addressed by 

the application. As with the cases where 

EPA has 180 days to act, this 360-day 

review period can be extended at the 

request of the state, tribe, or local 

government submitting the application. 

The rule provides for this extended 

review period to deal with the 

possibility that EPA will receive a large 

number of applications associated with 

existing systems just before the two-year 

deadline expires. If the number of such 

applications is sufficiently large, EPA 

may not be able to act on all of them 

within a 180-day review period. States, 

tribes, or local governments that wish to 

avoid the extended review may do so by 

submitting their applications addressing 

existing systems early enough in the 

two-year period to ensure that EPA can 

determine completeness before the 

deadline. As noted in section VI.B.2, 

EPA strongly encourages such early 

submissions wherever they are feasible. 

5. Public hearings for Part 142 

revisions or modifications. Where a 

complete application requests a revision 

or modification of an authorized public 

water system program under 40 CFR 

part 142, EPA will make a preliminary 

determination on the request—either an 

approval or a denial—by the end of the 

180-day review period (or the 360-day 

extended review period discussed in 

section VI.C.4). EPA will then publish a 

notice of the preliminary determination 

in the Federal Register. The notice will 

state the reasons for the preliminary 

determination, and will inform 

interested members of the public that 

they may request a public hearing on 

the preliminary determination. Such 

hearing requests must be submitted 

within 30 days of the notice’s Federal 

Register publication. If no requests are 

submitted, and the Administrator does 

not hold a hearing on his or her own 

motion, then the preliminary 

determination will be effective 30 days 

after the initial Federal Register 

publication. 

If a request for hearing is granted, or 

the Administrator determines that a 

hearing is warranted, EPA will publish 

an additional Federal Register notice 

announcing—at least 15 days in 

advance of any such hearing—the date 

and time of any hearing, contact 

information, and the purpose of the 

hearing. At the hearing, a hearing officer 

will receive oral and written testimony, 

and will forward a record of the hearing 

to the EPA Administrator. After 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59867 

reviewing the record of the hearing, EPA 

will by order either affirm or rescind the 

preliminary determination, and will 

publish notice of this decision in the 

Federal Register. If the order is to 

approve the revision or modification, 

the approval will be effective upon 

publication of the order in the Federal 

Register. 

6. Re-submissions and amendments. 

States, tribes, or local governments 

whose § 3.1000 applications for 

revisions or modifications have been 

denied in whole or in part may reapply 

for reconsideration, using either the 

§ 3.1000 procedures again, or, at their 

option, the applicable program-specific 

procedures. A state, tribe, or local 

government may also, on occasion, 

choose to amend a § 3.1000 application 

after the Administrator has determined 

the application to be complete. In such 

cases, the application will be considered 

to have been withdrawn and 

resubmitted as a new package, and a 

new 75-day completeness determination 

process will begin. An applicant may 

choose to withdraw and resubmit the 

package in this manner, for example, if 

it becomes clear relatively early into the 

180-day review period that the 

application cannot be approved in its 

current form. For such re-submissions, 

EPA will work diligently to expedite the 

completeness determination. 

D. What general requirements must 

state, tribe, and local government 

electronic reporting programs satisfy? 

States, tribes, and local governments 

that accept electronic reports in lieu of 

paper under their authorized programs 

must satisfy the requirements of 

§ 3.2000(b) and (c). Section 3.2000(b) 

sets forth the standards that acceptable 

electronic document receiving systems 

must satisfy, and these are explained in 

detail in section VI.E. In parallel with 

§ 3.4 on federal compliance and 

enforcement, § 3.2000(c) requires that 

the state, tribe, or local government be 

able to seek and obtain any appropriate 

civil, criminal or other remedies under 

state, tribe, or local law for failure to 

comply with a reporting requirement if 

a person submits an electronic 

document that fails to comply with the 

applicable provisions for electronic 

reporting. Similarly, § 3.2000(c) 

contains provisions to ensure that an 

electronic signature provided to a state, 

tribe, or local government will make the 

person who signs the document 

responsible, bound, and/or obligated to 

the same extent as he or she would be 

signing the corresponding paper 

document. 

Additionally, under § 3.2000(a)(2), the 

authorized program must require that 

any electronic document it accepts bear 

a valid electronic signature wherever 

the corresponding paper document 

would have to be signed under existing 

regulations or guidance, with the 

signatory being the same person who is 

authorized and/or required to sign 

under the current applicable provision. 

As in the case of direct reporting to EPA 

(see section V.A), the requirement for an 

electronic signature will apply only 

where the document would have to bear 

a signature were it to be submitted on 

paper, either because this is required by 

statute or regulation, or because a 

signature is required to complete the 

paper form. This rule does not require 

that authorized programs impose any 

new or additional signature 

requirements for electronic documents 

that are submitted in lieu of paper and 

were not previously required to be 

signed when submitted in paper form. 

As with direct reporting to EPA, 

§ 3.2000(a)(2) also allows an authorized 

program to make special provisions for 

the required signatures to be executed 

on follow-on paper submissions. As 

noted in section IV.C, such provisions 

must ensure that the paper submission 

containing the signatures is adequately 

cross-referenced with the electronic 

document being signed, and must be 

described as a part of the § 3.1000(b)(1) 

application. Systems that receive 

electronic documents with such followon paper signature submissions are 

subject to all applicable § 3.2000(b) 

requirements, including the requirement 

that the electronic document cannot be 

altered without detection after the 

signature has been executed. 

E. What standards must state, tribe, and 

local government electronic document 

receiving systems satisfy? 

Section 3.2000(b) specifies the 

standards that electronic document 

receiving systems must satisfy if they 

are to be approved for use by states, 

tribes, or local governments to receive 

electronic documents in lieu of paper 

under an EPA-authorized program. 

EPA’s purpose in specifying such 

standards remains the same as it was 

when EPA specified the proposed 

§ 3.2000 criteria in proposed CROMERR. 

As discussed in section IV.B.1, that 

purpose was to ensure that 

electronically submitted documents 

have the same ‘‘legal dependability’’ as 

their paper counterparts, so that any 

electronic document that may be used 

as evidence to prosecute an 

environmental crime or to enforce 

against a civil violation has no less 

evidentiary value than its paper 

equivalent. EPA has been motivated to 

provide for the legal dependability of 

electronic documents submitted under 

authorized programs by considering, 

among other things: 

• The roles that many electronically 

submitted documents would likely play 

in environmental program management, 

including compliance monitoring and 

enforcement; 

• EPA’s statutory obligation to ensure 

that authorized or delegated programs 

maintain the enforceability of 

environmental law and regulations; and 

• The consequent need to ensure that 

enforceability is not compromised as 

authorized programs make the transition 

from paper to electronic submission of 

compliance or enforcement-related 

documents. 

The § 3.2000(b) standards for electronic 

document receiving systems in today’s 

rule provide an expanded version of 

what had been the proposed § 3.2000(b) 

‘‘Validity of Data’’ criterion. Like 

proposed § 3.2000(b), final § 3.2000(b) 

requires that electronic document 

receiving systems reliably enable EPA, 

states, tribes, and local governments to 

prove, in civil and criminal enforcement 

proceedings, that the electronic 

documents they receive and maintain 

are what they purport to be, that any 

changes to their content are 

documented, and that any associated 

signatures were actually executed by the 

designated signatories intending to 

certify that content. Systems must be 

able to satisfy the § 3.2000(b) 

requirements for any electronic 

documents they receive that are 

submitted in lieu of paper to satisfy an 

authorized program requirement. 

The following discussion highlights 

some of the § 3.2000(b) requirements for 

electronic document receiving systems. 

The first five of these requirements 

(timeliness of data generation, copy of 

record, integrity of the electronic 

document, submission knowingly, and 

opportunity to review and repudiate 

copy of record) apply to all electronic 

document receiving systems. The other 

highlighted requirements (validity of the 

electronic signature, binding the 

signature to the document, opportunity 

to review, understanding the act of 

signing, the electronic signature or 

subscriber agreement, acknowledgment 

of receipt, and determining the identity 

of an individual) apply only to systems 

that receive electronically signed 

documents. 

1. Timeliness of data generation. 

Section 3.2000(b) reflects the role that 

electronic document receiving systems 

play in supporting a wide range of 

compliance and enforcement-related 

activities, including compliance 

research and analysis, civil actions, and 

59868 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

litigation, and the fact that the success 

of such activities may be affected by the 

relative ease or difficulty of accessing 

the data related to electronic 

submissions. Accordingly, electronic 

document receiving systems must 

provide timely access to such data, 

especially to data relevant to the 

questions of what was submitted, by 

whom, and, where signatures are 

involved, who the signatories were and 

to what they certified. Much of this data 

may be assembled in the copy of record, 

together with any data needed to 

establish that the copy is a ‘‘true and 

correct copy of an electronic document 

received,’’ as specified by the § 3.3 copy 

of record definition. To help the litigator 

develop evidence and present it in the 

courtroom, it is advisable that the copy 

of record be maintained and made 

accessible in a form and format that 

requires the minimum possible 

‘‘assembly’’ of its elements, so that its 

connection with what was received and 

what was certified to by any signatories 

is easy to understand and to 

demonstrate to others. 

2. Copy of record. Under § 3.2000(b), 

an acceptable electronic document 

receiving system must retain and be able 

to make available a copy of record for 

each electronic document it receives 

that is submitted in lieu of paper to 

satisfy requirements under an 

authorized program. For such 

submissions, the copy of record is 

intended to serve as the electronic 

surrogate for what we refer to as the 

‘‘original’’ of the document received 

where we are doing business on paper. 

The copy of record is meant to provide 

an authoritative answer to the question 

of what was actually submitted and, as 

applicable, what was signed and 

certified to in the particular case. 

As defined in § 3.3, a copy of record 

must satisfy at least four requirements. 

First, it must be a true and correct copy 

of the electronic document that was 

received. In the case of documents 

consisting of data, this means that the 

copy of record must contain exactly the 

set of data elements that constituted the 

electronic document that was 

submitted. In the case of a document 

consisting of other forms of information, 

e.g., text or images, being a ‘‘true and 

correct copy,’’ may mean including file 

and or visual format information along 

with the items of information 

themselves, to the extent the meaning of 

these items is dependent on format. (See 

the discussion of the definition of 

‘‘electronic document,’’ in section 

IV.D.1.) For the copy of record to fulfill 

its intended role, it is not enough that 

it be a true and correct copy; it must 

also be capable of being shown to be a 

true and correct copy; otherwise, it 

cannot meet other related system 

requirements, such as establishing 

document integrity. (See section VI.E.3, 

below.) The copy of record is shown to 

be true and correct in part by virtue of 

its not being repudiated by the 

submitters and/or signatories where it is 

made available for their review and 

repudiation. (See section VI.E.5., 

below.) In addition, the system must 

provide sufficient evidence to show 

how the copy of record was derived 

from and accurately reflects the 

electronic document as it was received 

by the system; such evidence is also 

necessary to establish document 

integrity. To provide for such evidence, 

the system may need to establish a 

chain of custody for the copy of record, 

particularly if there are a number of 

processing steps that separate the copy 

of record from the file as it enters the 

system. On the other hand, where the 

copy of record captures and preserves 

the file containing the electronic 

document exactly in the form and 

format in which it is received, then a 

chain of custody may not be necessary. 

Considerations of ‘‘timeliness’’ favor 

maintaining copies of record in a way 

that would not require a chain of 

custody. (See section VI.E.1., above.) 

Second, the copy of record must 

include all the electronic signatures that 

have been executed to sign the 

document or components of the 

document. The method of inclusion 

may vary, depending on the nature of 

the signature. With a digital signature, 

created by encrypting a hash of the 

document being signed with the private 

key in a private/public key-pair, the 

signature is simply a number that can 

and should be contained as a copy of 

record element. There is no risk of 

signature theft in this case. Each digital 

signature is bound to the specific 

document it signs, and the private key, 

which is actually used for signing, is 

inaccessible to a would-be intruder. 

With other forms of signature such as 

personal identification numbers (PINs) 

or passwords, items of personal 

information, or biometric images or 

values, including the signature as a copy 

of record element may raise signature 

theft issues. At least in theory, such 

signatures could be detached or copied 

from a copy of record and re-used 

spuriously without detection. To 

address this risk, the signature, 

especially in the case of a PIN or 

password, may be encrypted for storage, 

perhaps together with a hash of the 

document signed, to bind the signature 

to the document content. Another 

approach may be to validate the 

signatory’s identity, e.g. by comparing a 

signatory-generated password with an 

encrypted version maintained securely 

at the electronic document receiving 

system. In such cases, the signatorygenerated password—which might be 

regarded as the signature—never 

actually appears on the electronic 

document, so the signature that is 

‘‘included’’ in the copy of record may be 

an encrypted form of the signature, or 

possibly nothing exactly corresponding 

to a signature at all, but rather pointers 

or references to the processes or 

encrypted data that provide the actual 

link to the signatory. There are 

analogous strategies for biometric 

signatures. For example, the validity of 

a biometric (e.g., a finger print, a retinal 

scan, etc.) may be established by using 

certain statistical algorithms to evaluate 

data provided by the biometric. In such 

cases, the copy of record might 

document the process of validating the 

signature, but without including the 

biometric data that was used to show 

that the signature was valid. On any of 

these approaches, the copy of record 

may satisfy the requirement that the 

copy ‘‘include’’ the signatures, provided 

that what the copy does contain serves 

to establish whether the electronic 

document in question was signed and 

by whom. 

Third, the copy of record must 

include the date and time of receipt to 

help establish its relation to submission 

deadlines, to the circumstances of its 

submission, and to other possibly 

associated documents that may have 

been submitted or alleged to have been 

submitted. This is not generally 

problematic, except in cases of 

continuous streams of data conveyed to 

the system. For such continuous data, 

reasonable alternatives may be 

substituted that serve the same 

purposes, for example, associating 

stages of the data flow with dates and 

times, say, at hourly intervals. Similarly, 

the copy of record may include other 

additional information to the extent that 

this is needed to establish the meaning 

of the content and the circumstances of 

receipt. Such additional information 

might include data field labels, 

signatory information such as references 

to PKI certificates, and transmission 

source information. 

Fourth, the copy of record must be 

viewable in a human-readable format 

that clearly indicates what the submitter 

and, where applicable, the signatory 

intended that each of the data elements 

or other information items in the 

document means. This supports the 

copy of record’s role as a surrogate 

‘‘original’’ of the paper document, and 

serves to establish the content of the 

document as it was signed and/or 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59869 

submitted. The copy of record may 

satisfy this requirement in many 

different ways. It might actually include 

explicit labels or descriptions for each 

data element or information item, or 

preserve a visual format in which the 

data were submitted. Alternatively, it 

may incorporate a conventional 

ordering of the items or elements, where 

the information that associates such 

ordered data with labels, descriptions, 

or other means of visual display is 

maintained externally and can be 

invoked as needed—for example, to 

make the data elements appear within 

fields in the image of a filled-out form. 

Where the electronic document is 

created off-line by the submitter and 

conveyed as a whole to the receiving 

system, it is preferable for the copy of 

record to reflect the mechanism or 

format for indicating meaning supplied 

in the submission. For example, if the 

submission is in some standard 

electronic data interchange format, then 

the copy of record might usefully 

preserve that format. Taking this 

approach will help to resolve potential 

chain of custody issues if questions 

arise about whether the copy of record 

is true and correct. However, in cases 

where the electronic document is 

created on-line, for example, through 

the use of a web-form, the format for the 

copy of record will of necessity be an 

artifact of the electronic document 

receiving system itself. This is not 

problematic, as long as the system 

provides a way to ensure that the 

meaning of each data element as 

supplied by the submitter remains 

unambiguous. 

Some commenters objected to copy of 

record requirements because of the 

potential expense of redesigning 

systems that are not currently capable of 

creating and storing electronic copies of 

records. EPA notes, however, that 

systems satisfying copy of record 

requirements need not preserve the 

electronic documents received in 

separate or special storage apart from 

the files that maintain the data or 

information content of the documents. 

For example, data loaded from 

submitted electronic documents to a 

database may satisfy copy of record 

requirements where the stored content 

includes the signatures, the date/time of 

receipt, and an adequate chain of 

custody. This may be the most practical 

copy of record approach for receiving 

continuous data streams. Such an 

approach does not preclude satisfying 

the requirement that the copy of record 

be viewable in a human-readable 

format. The requirement does not mean 

that the data must be stored in a humanreadable format, so long as there is a 

well-documented way to display the 

stored data in such a format. In 

addition, nothing in the ‘‘copy of 

record’’ definition requires such copies 

to be electronic. Particularly where the 

signature involves some easily 

represented numerical value, the copy 

of record may be created and 

maintained in an imaging medium or on 

paper, provided that such copies can be 

shown to have been created by the 

electronic document receiving system to 

be true and correct copies of the 

electronic documents received. Whether 

such alternatives are appropriate as 

interim or even long-term solutions will 

depend on individual circumstances. It 

may be difficult to provide a copy of 

record for review and possible 

repudiation if the copy is not available 

as an electronic document that can be 

viewed on-line or downloaded through 

the network. 

3. Integrity of the electronic 

document. Under § 3.2000(b)(1)—(2), an 

acceptable electronic document 

receiving system must be able to 

establish that a given electronic 

document was not altered without 

detection in transmission or at any time 

after receipt, and any such alterations 

must be fully documented. For purposes 

of § 3.2000(b)(1)—(2), EPA excludes 

alterations that have no effect on the 

document’s information content. 

Examples of excluded alterations 

include the separation of a transmitted 

file into packets and their error-free 

recombination, the error-free processes 

of file compression and extraction, as 

well as certain disk maintenance 

functions that may, for example, involve 

physically repositioning file 

components on the storage medium. To 

satisfy § 3.2000(b)(1)—(2) requirements 

with respect to alterations that do affect 

information content, a system may rely 

on a number of different but 

complementary capabilities, including 

general provisions for system security, 

access control, and secure transmission. 

Additionally, the system’s copy of 

record provisions help make the case 

that the electronic document is 

unaltered, or has been altered only as 

documented (for example, through a 

chain of custody), a case which is 

strengthened where submitters and/or 

signatories have had the opportunity to 

review the copy and have not contacted 

the system to repudiate the copy. 

Finally there are specific technical 

approaches to ensuring integrity, based, 

for example, on calculating hash values 

associated with the document content. 

4. Submission knowingly. Under 

§ 3.2000(b)(3), an acceptable electronic 

document receiving system must 

provide evidence that the submitter had 

some reliable way of knowing and/or 

confirming that the submission took 

place. This requirement is necessary to 

help establish submitter responsibility 

for the electronic document and to rule 

out spurious submissions, whether by 

accident or through the actions of an 

unauthorized submitter or ‘‘hacker.’’

EPA believes that to satisfy this 

requirement, the system must have 

some follow-on communication with 

the submitter related to the submission. 

This could be a communication 

initiated by the submitter in cases where 

it is realistic to rely on submitters to 

regularly check the system for evidence 

of documents submitted; where such 

submitter interactions are relied upon, 

they must be documented. 

Alternatively, the system must send 

some form of acknowledgment of 

submission as a response to the 

submitter named, and must document 

such acknowledgments, recording at 

least their date, time, content and the 

addresses to which they were sent. For 

cases where the electronic document 

bears an electronic signature, this 

acknowledgment is explicitly provided 

for under § 3.2000(b)(5)(vi). (See section 

VI.E.11.) 

5. Opportunity to review and 

repudiate copy of record. Under 

§ 3.2000(b)(4), the copy of record must 

be available for review and timely 

repudiation by the individuals to whom 

the document is attributed, as its 

submitters and/or signatories. The fact 

that the copy was available for this 

review and was not repudiated provides 

strong support for its being a ‘‘true and 

correct copy of an electronic document 

received,’’ as specified by the § 3.3 copy 

of record definition. Program managers 

normally would set reasonable end 

dates for this process, especially where 

there is concern that the copy is not 

‘‘officially’’ a copy of record until the 

process is complete. 

Satisfying this ‘‘opportunity to 

review’’ provision involves at least two 

requirements. The first is that the 

identified submitters and/or signatories 

must have some way of knowing that 

their submission was received, and that 

a copy of record is available for review. 

This requires some follow-on 

communication with the submitters and 

signatories related to the submission—

initiated either by the submitters/ 

signatories or by the system, as 

discussed in section VI.E.4. Approaches 

should be avoided that allow the initial 

submission and provision of copy of 

record to occur as a part of the same online session, because in cases of 

spurious submission the identified 

submitters/signatures may never learn 

59870 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

that a copy of record exists. Second, to 

ensure that the opportunity to review 

and repudiate is meaningful, the copy of 

record must be viewable in a humanreadable format that clearly and 

accurately associates all the information 

elements of the electronic document 

with descriptions or labeling of those 

elements. This second requirement is 

consistent with the definition of ‘‘copy 

of record,’’ as discussed in section 

VI.E.2. 

6. Validity of the electronic signature. 

Under § 3.2000(b)(5)(i), for each 

electronic document that is required to 

bear an electronic signature, the 

receiving system must be able to 

establish that each electronic signature 

was a valid electronic signature at the 

time of signing. Under § 3.3, as 

discussed in section IV.D.5, a valid 

electronic signature must satisfy three 

conditions. The first is that the signature 

must be created with a signature device 

that is ‘‘owned’’ by the individual 

designated as signatory—‘‘owned’’ in 

the sense that this individual is 

uniquely entitled to use it for creating 

signatures. To establish this, an 

electronic document receiving system 

must be able to identify signature device 

‘‘owners’’ and must be able to determine 

that an identified signatory is the owner 

of the device used to create the 

signature in question. Section 

3.2000(b)(5)(vii) explicitly requires the 

ability to identify signature device 

owners, and section VI.E.12 of this 

Preamble discusses the 

§ 3.2000(b)(5)(vii) requirements in 

detail. 

Concerning the determination that an 

identified signatory is the owner of the 

device used to create the signature, the 

system needs to have unique signature 

validation criteria for each identified 

signature device owner who submits 

electronically signed documents; the 

system must be able to apply these 

criteria to each signature on documents 

received. For example, in the case of a 

digital signature, the validation criteria 

include the existence of a valid PKI 

certificate for the identified signatory 

and the ability of the associated public 

key to decrypt the encrypted message 

digest that constitutes the signature. In 

the case of a PIN, the validation 

criterion may be simply that the PIN 

added to the document as a signature 

matches the PIN on file for the 

identified signatory. 

The second condition for an 

electronic signature to be considered 

valid is that the signature must be 

created with a device that has not been 

compromised. That is, at the time of 

signing, the electronic signature device 

must in fact be available only to the 

individual identified as its owner, and 

to no one else. Otherwise, the use of the 

device to create the electronic signature 

may not provide evidence that a 

specific, identifiable individual has 

certified to the truth or accuracy of an 

electronic document. Accordingly, an 

acceptable electronic document 

receiving system must provide evidence 

that the electronic documents it receives 

and maintains do not contain signatures 

executed with compromised devices. 

Such evidence will document the 

system’s approach to three related 

functions: prevention of signature 

device compromise, detection of 

compromises where they occur, and 

rejection of known compromised 

submissions. 

The approach to prevention will 

include the way the system notifies 

submitters of their obligations to avoid 

signature compromise, including the 

obligation not to share or delegate the 

use of the device as a part of the 

electronic signature agreement. (See 

sections IV.D.4 and VI.D.8. of this 

Preamble, respectively.) Prevention also 

involves choosing the kinds of signature 

devices to support and determining how 

they are to be used. Some devices are 

inherently vulnerable to compromise, 

for example, because protection from 

spurious use relies on ‘‘secret’’ (such as 

a PIN or password) that has to be shared 

when the device is used. However, 

vulnerable devices can sometimes be 

strengthened with appropriate 

implementation. In the case of a PIN or 

password, adding an element that does 

not rely on secrecy—e.g. a physical 

‘‘token,’’ such as a smart card or 

employee badge—that had to be used 

along with the PIN or password may 

greatly reduce the device’s 

vulnerability. Alternatively, a system 

accepting secret-based signatures might 

be programmed to query the would-be 

signatory about a randomly selected 

piece of private information that has 

been (or could be) verified. This 

approach would also reduce 

vulnerability to compromise, since the 

discovery of a secret number or 

password does not convey other private 

information about the secret’s owner. 

For detection of compromises, there 

are two complementary approaches. The 

first is to ensure that the system 

recognizes the signs of spurious 

submission, for example, duplicate 

reports, off-schedule submissions, and 

deviations from normal content or 

procedure. The second is to ensure that 

the system empowers submitters to 

detect and report spurious submissions 

by providing the regular ‘‘out of band’’

acknowledgments discussed in section 

VI.E.11. Once spurious submissions are 

detected, the system must ensure their 

rejection, and the rejection of any 

subsequent submissions that use the 

same device. An acceptable receiving 

system must provide for timely 

revocation or suspension of access by 

those individuals with compromised 

signature devices. 

Finally, a signature must be created 

by an individual who is authorized to 

do so, primarily by virtue of his or her 

relationship with the regulated entity on 

whose behalf the signature is executed. 

An electronic document receiving 

systems must be able to determine 

whether the identified signatories have 

the necessary relationship with the 

regulated entity that enables them to 

sign the documents being submitted. 

Generally, the system would obtain the 

information necessary for these 

determinations along with establishing 

the identity of the signature device 

owners. Section VI.E.12 of this Preamble 

discusses this point in more detail. 

The system must also have some way 

to keep this information up-to-date, for 

example, some way to reject signatures 

where it is known that the signature 

device owner is no longer authorized to 

sign the electronic document in 

question. As with the initial registration 

process, the provisions for updating this 

information may vary. For some cases, 

it may be sufficient to rely on voluntary 

notifications from registrants when, e.g., 

their job status changes. For other cases, 

it may be appropriate to identify a 

responsible company official who is 

charged with managing the 

authorizations of employees signing 

documents on behalf of the company, to 

include keeping records of changes in 

authorization status and/or sending 

notifications. For certain cases, the 

system might limit a signature device 

owner’s authorization to a defined 

period, which could be extended only 

through a re-registration process. 

7. Binding the signature to the 

document. Under § 3.2000(b)(5)(ii), an 

acceptable electronic document 

receiving system must establish that 

electronic documents cannot be altered 

without detection once such documents 

are signed. Well-implemented 

provisions for copy of record help 

satisfy this requirement. The fact that a 

signatory has not repudiated a 

document’s copy of record that he or 

she has had the opportunity to review 

provides evidence that the copy 

accurately reflects the document as it 

was signed. However, even where the 

signatory affirms the authenticity of the 

copy of record at the time of review, he 

or she may still repudiate the document 

at a later date. Therefore, an acceptable 

electronic document receiving system 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59871 

must provide a method of ensuring that 

any breach of a signed document’s 

integrity can be detected. As discussed 

in section IV.B.2., such methods are 

available in the form of signatures that 

incorporate a hash value of the content 

being signed, or in the form of signature 

processes that involve the creation of 

this hash and its maintenance in 

association with the signed document. 

Encrypting the hash value, for example, 

by executing a digital signature, provide 

the strongest approach to rebutting 

claims that the hash has been 

manipulated. Encryption may not be 

necessary to the extent that the system 

provides other means to prevent 

tampering and establish that the hash 

has not been altered since it was 

calculated. 

8. Opportunity to review. Where a 

signatory is certifying to the truth or 

accuracy of document content, the 

certification represents the signatory as 

knowing and understanding the content, 

as well as certifying to its truth. Under 

§ 3.2000(b)(5)(iii), an acceptable 

electronic document receiving system 

must be able to provide evidence that 

the signatory had the opportunity to 

review what he or she was signing in a 

human-readable format. Providing this 

evidence may be relatively simple, 

depending on the signature/certification 

scenarios that the system provides for or 

allows. In a case where the system only 

allows signature/certification during an 

on-line client-server session, and where 

the server always explicitly gives the 

signatory the option of scrolling through 

an appropriately-formatted display of 

the submission content before signing, 

documenting these server functions 

should suffice to provide the required 

evidence. Cases that may be similarly 

straightforward include those where 

signature/certification takes place offline, at the signatory’s computer, but 

using software provided by or certified 

by the governmental entity whose 

system will receive the signed electronic 

document. In this case, the evidence is 

provided by documenting how the 

software works. Less straightforward are 

cases where the signature/certification 

software is completely beyond the 

control of the governmental entity. In 

such cases, evidence of the opportunity 

to review may need to rely on the use 

of a submission format that 

demonstrably allows a human-readable 

display of the content. For example, the 

fact that the file format is a Word or 

Excel file and that the file provides a 

human readable display when opened 

with the right program may constitute 

sufficient evidence that the opportunity 

to review has been provided. 

9. Understanding the act of signing. 

Where a signatory is certifying to the 

truth or accuracy of document content, 

the certification affirmatively represents 

that the signatory understands both 

what the act of signing means and that 

he or she is subject to criminal liability 

for false certification. Reporting formats 

in the paper medium provide evidence 

that certifications are made with the 

requisite understandings by placing the 

certification statement in a clearly 

visible position near the place where 

signatures are to be affixed and by 

prominently displaying the statement 

that there are criminal penalties for false 

certification. Under § 3.2000(b)(5)(iv), 

an acceptable electronic document 

receiving system must ensure that such 

statements are presented in conjunction 

with electronic signature/certification. 

Satisfying this requirement is 

straightforward where the system itself 

provides for the signature process or 

where the governmental entity receiving 

the submission provides or otherwise 

has control over the signature/ 

certification software being used. In 

other cases, satisfaction will depend on 

requiring that the signatories and/or 

submitters incorporate such statements 

into their documents before they are 

signed or into screens that are displayed 

prior to signature. Confidence that the 

requirement is satisfied will depend in 

part on the extent to which the 

submission process involves the use of 

common, easy-to-display file structures 

together with the software to display the 

files being signed. 

10. The electronic signature or 

subscriber agreement. Under 

§ 3.2000(b)(5)(v), an acceptable 

electronic document receiving system 

must be able to provide evidence that 

any signatory of documents received by 

the system has signed an electronic 

signature agreement or subscriber 

agreement with respect to the electronic 

signature device he or she uses to sign 

the documents. ‘‘Electronic signature 

agreement’’ and ‘‘subscriber agreement’’

are defined under § 3.3, the latter 

referring to electronic signature 

agreements that are executed with ink 

on paper. (The distinct role of 

subscriber agreements is explained in 

section VI.E.12.) By signing such 

agreements, an individual agrees to 

protect his or her signature device from 

compromise, that is, to keep a secret 

code secret, a hardware token secured, 

etc., and not to deliberately compromise 

the device by making it available to 

others. He or she also agrees to promptly 

report any evidence that the device has 

been compromised, for example, to 

promptly notify the system manager if 

he or she receives system 

acknowledgments of submissions he or 

she did not make, or if the device has 

become available to others. Finally, by 

signing the electronic signature or 

subscribed agreement, an individual 

agrees that use of his or her electronic 

signature device to sign documents 

creates obligations and/or legally binds 

him or her to the same extent as he or 

she would be bound or obligated by 

executing handwritten signatures. EPA 

believes that such agreements are 

necessary to assure—and provide 

evidence—that the signatory recognizes 

his or her obligations with respect to the 

electronic signature device. Insofar as 

the institutions surrounding the use of 

electronic signatures are relatively new, 

EPA believes that express recognition of 

signatory obligations through explicit 

agreements avoids potential ambiguity 

or misunderstandings. 

11. Acknowledgment of receipt. 

Where an electronic signature is used to 

certify to the truth or accuracy of 

document content—with criminal 

liability for false certification—then it is 

especially important to ensure that any 

individual identified as signatory has 

the opportunity to detect and repudiate 

any spurious submissions made in his 

or her name through unauthorized 

access to signature device and/or the 

electronic document receiving system. 

To provide for this, § 3.2000(b)(5)(vi) 

requires the system to automatically 

send acknowledgments of document 

receipt to the individuals in whose 

names the submissions are made, the 

acknowledgments in each case 

identifying the document in question, 

the signatories, and the date and time of 

receipt. 

Additionally, § 3.2000(b)(5)(vi) 

requires that each acknowledgment be 

sent to an address with access controls 

different and separate from those that 

enable the submission itself, so that in 

cases of compromised access, the 

individual in whose name a submission 

is made would still receive the 

acknowledgment without interference. 

This is sometimes referred to as ‘‘out of 

band’’ acknowledgment. In web-based 

commerce, this is fairly standard 

practice—a purchase is normally 

acknowledged directly to the internet 

protocol (IP) address from which the 

purchase is made, as a part of the online session, but also is confirmed 

through a follow-up communication to 

an email address. Note that while the 

‘‘out of band’’ acknowledgment is 

normally sent electronically, electronic 

transmission is not required. A paper 

acknowledgment sent by U.S. Mail, or a 

voice acknowledgment via telephone 

would serve the same purpose so long 

59872 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

as these are documented by the system 

so they may be produced, possibly as 

evidence, at a later date. 

12. Determining the identity of the 

individual uniquely entitled to use a 

signature device. As discussed in 

section VI.E.6, a system cannot accept 

an electronic signature as valid unless it 

establishes an identity between the 

individual designated as signatory and 

the owner of the device used to create 

the signature. Any circumstance casting 

doubt on the device’s ownership 

undermines the certainty that signatures 

created with the device are valid; if it’s 

not certain whose device created the 

signature then it’s not certain whether 

the actual signatory is the individual 

who is designated as signatory in the 

submitted document. Additionally, it 

must be clear what the signature device 

owner’s relation is to the entity on 

whose behalf a document is signed, in 

order to be certain that this device 

owner is an authorized signatory. This 

is also a condition of signature validity. 

(See section VI.E.6.) Accordingly, to 

assure that electronically signed 

documents are legally reliable, a system 

accepting such documents must have a 

process for determining who owns the 

signature devices used to create the 

signatures, and their relations to the 

entities on whose behalf they sign 

submitted documents. Section 

3.2000(b)(5)(vii) explicitly reflects this 

performance standard by requiring that 

a system provide for such 

determinations ‘‘with legal certainty.’’

That is, the system must be able to 

provide evidence sufficient to prove the 

signature device owner’s identity and 

relation to entities on whose behalf he 

or she signs in a context where 

designated signatories may have an 

interest in repudiating their signature 

device ownership or in distancing 

themselves from the entities on whose 

behalf they are supposed to have signed. 

Section 3.2000(b)(5)(vii) does not 

specify how this performance standard 

is to be met, however, at a minimum, an 

‘‘identity-proofing’’ capability must 

involve access to a set of descriptions 

that apply uniquely to the individual in 

question and refer to attributes that are 

durable, documented, and objective. 

Such descriptions must be capable of 

being shown at any time to uniquely 

identify the individual without having 

to depend on anyone who might have 

an interest in repudiating the 

identification. Section 3.2000(b)(5)(vii) 

requires that more specific conditions 

be met for the special class of 

electronically signed documents that are 

included in the list that defines 

‘‘priority report’’ under § 3.3 and 

Appendix 1 to Part 3. The priority 

reports are those that EPA has identified 

as likely to be material to potential 

enforcement litigation. Given this 

likelihood, it is important to provide not 

only for the provability of signature 

device ownership in principle, but for 

the practical need to make this proof 

with the resources typically available to 

enforcement staff and within the 

constraints of the judicial process in 

criminal and civil proceedings. To 

address this practical dimension of 

identity-proofing in the case of priority 

reports, § 3.2000(b)(5)(vii) adds three 

conditions to the general performance 

standard. The first is that the identity of 

a signature device owner must be 

verified before the system accepts any 

electronic signature created with the 

device. The second, in 

§ 3.2000(b)(5)(vii)(A), is that this 

verification must be ‘‘by attestation of 

disinterested individuals.’’ The third 

condition, also contained in 

§ 3.2000(b)(5)(vii)(A), specifies that the 

verification be ‘‘based on information or 

objects of independent origin, at least 

one item of which is not subject to 

change without government action or 

authorization.’’

Regarding the first condition, 

requiring identity-proofing before the 

signature device is used helps prevent 

systems from accepting electronic 

signatures that cannot be proved to be 

valid in the context of an enforcement 

proceeding. This is at least a potential 

concern in any case of electronic 

signature, but it is also a very real 

concern in cases where what is signed 

is a priority report. The second 

condition anticipates the need to prove 

signature device ownership in court, by 

ensuring the availability of someone 

credible to offer testimony about the 

device owner’s identity who does not 

have an interest in repudiating device 

ownership. This is the idea of 

verification by a ‘‘disinterested 

individual,’’ the term defined under 

§ 3.3 as ‘‘a person who is not the 

employer; the employer’s corporate 

parent, subsidiary, or affiliate; 

contracting agent; or relative (including 

spouse or domestic partner) of the 

individual in whose name the electronic 

signature device is issued.’’ The 

condition suggests an identity-proofing 

process carried out by a trusted third 

party, and, in the current electronic 

commerce environment, this would 

typically be a PKI certificate authority 

(CA), whose business is to issue 

certificate-based electronic signature 

devices that reflect identity-proofing at 

a specified level of assurance. However, 

it is important to be clear that 

verification by a ‘‘disinterested 

individual’’ does not have to involve a 

PKI-based approach to electronic 

signatures. Indeed, it does not have to 

involve a third party at all; the 

disinterested individual could simply 

be an employee of the agency operating 

the electronic document receiving 

system, if that agency itself has the 

resources to provide for identityproofing as it registers signature device 

owners to use the system. Additionally, 

if a trusted third party is wanted, there 

are alternatives to the CA. For example, 

with an appropriately defined 

procedure, a notary public or some local 

government official could play this role; 

so could some other governmental 

agency, such as department of motor 

vehicles, which is in the business of 

issuing credentials based (usually) on 

in-person verification of identity. 

The third condition sets a standard for 

the evidence on which verification of 

identity would be based—evidence that 

would be attested to by the disinterested 

individual provided for by the second 

condition. The standard refers to 

‘‘information or objects’’ and for each 

requires that they be ‘‘of independent 

origin’’ and include at least one item 

that requires ‘‘governmental action or 

authorization’’ to change. Information 

‘‘of independent origin’’ must be 

knowable empirically, and not simply 

as a matter of someone’s say so; objects 

of independent origin could provide 

such information. Such information, 

where it concerns an individual’s 

identity, would generally come from 

three sources: first, documented, direct, 

in-person contact; second, 

documentation of the individual’s 

history—e.g., as an employee, a 

consumer, a student, etc.—with objects 

such as credit cards, passports, etc., 

sometimes together with corroborating 

testimony; and third, forensic evidence 

of unique, immutable traits, from such 

objects as fingerprints, photos, and 

handwritten signatures. 

Evidence of identity from any of these 

three sources will meet the 

§ 3.2000(b)(5)(vii)(A) standard, provided 

that the information used also includes 

at least one item that cannot be changed 

without governmental action or 

authorization—for example, a social 

security number, a passport number, or 

a driver’s license number. This last 

requirement helps assure that the 

identifying information used is 

sufficiently well-documented and 

durable to support re-verification of 

identity at some later date. The 

requirement also facilitates identityproofing that relies on database 

searches, insofar as data on individuals 

tends to be keyed to government-issued 

identifiers. Finally, while such 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59873 

identifiers are items of information, they 

typically are presented on objects—e.g. 

a driver’s license or a passport—that 

provide independent evidence of their 

authenticity. 

EPA recognizes that the identityproofing requirements specified in 

§ 3.2000(b)(5)(vii)(A) may be difficult to 

implement in some cases. The rule 

therefore allows a system to meet the 

§ 3.2000(b)(5)(vii)(A) requirements for 

cases of priority reports in other ways. 

Under § 3.2000(b)(5)(vii)(C), a system 

may collect a subscriber agreement (see 

section VI.E.10) from each signatory of 

the priority reports received by the 

system, in lieu of satisfying 

§ 3.2000(b)(5)(vii)(A). Alternatively, the 

system may collect a certification from 

a ‘‘local registration authority’’ (LRA) 

that such a subscriber agreement has 

been executed and is being securely 

stored. As defined under § 3.3, an LRA 

is an individual who plays the role of 

a custodian of subscriber agreements, 

maintaining these paper agreements as 

records and sending the system a 

certification of receipt and secure 

storage for each such agreement he or 

she receives. The presumption is that 

such certifications would be sent 

electronically to the system as signed 

electronic documents. To become an 

LRA, an individual must have his or her 

identity established by notarized 

affidavit, and must be authorized in 

writing by the regulated entity to issue 

these ‘‘agreement collection 

certifications’’ (defined under § 3.3) on 

its behalf. 

A state, tribe, or local government 

adopting the subscriber agreement 

alternative might chose to implement 

through LRAs as a way of reducing the 

pieces of paper it had to manage in 

operating its electronic document 

receiving system. While setting up the 

LRA relationships requires the 

collection of affidavits and 

authorizations on paper, this involves 

far fewer paper transactions than 

collecting the individual subscriber 

agreements from each person who signs 

priority reports. However, only larger 

companies or facilities with many 

employees signing priority reports are 

likely to be motivated and able to 

designate a company official as an LRA. 

Although nothing in the rule prohibits 

third parties from serving as LRAs for 

the smaller companies, a subscriber 

agreement implementation will 

probably always involve accepting some 

of these agreements directly from 

priority report signatories. What is 

essential under § 3.2000(b)(5)(vii)(C) is 

that a subscriber agreement be available, 

as needed, to establish the identity of 

the associated signature device owner. 

Identity in this case is established based 

on the forensic properties of the 

handwritten signature on the agreement. 

Finally, § 3.2000(b)(5)(vii)(B) gives 

states, tribes, or local governments the 

flexibility to propose identity-proofing 

methods that may not meet the specific 

requirements of § 3.2000(b)(5)(vii)(A), 

but which are no less stringent than the 

methods that satisfy 

§ 3.2000(b)(5)(vii)(A). For example, if a 

method of electronic identity-proofing 

were proposed that relies on the 

attestations of an LRA who is not a 

disinterested party, EPA would look for 

other features in the identity-proofing 

method that guarantee the identity of 

the LRA and the trustworthiness of the 

identity-proofing that the LRA would 

conduct. Similarly, if an identityproofing method were proposed that 

relies on objects or information that are 

not of independent origin (e.g., a 

company identification card), EPA 

would look for other features in the 

authentication method that guarantee 

that the registrant’s identity could not 

have been manufactured by the 

registrant or another interested party. 

EPA’s expectation is that the advance of 

technology may also make new methods 

of identity-proofing available that meet 

the needs of the enforcement 

community, and we expect that 

§ 3.2000(b)(5)(vii)(B) could be used to 

accommodate such new methods when 

implemented as part of electronic 

document receiving systems. 

VII. What are the costs of today’s rule? 

A. Summary of Proposal Analysis 

The Agency has conducted a number 

of analyses to ensure that this rule 

complies with the various statutory and 

administrative requirements that apply 

to EPA regulations. The results of the 

analyses are summarized in this section. 

In the proposal, EPA estimated that 

the proposed rule could result in an 

average annual reduction in burden of 

$52.3 million per year for those facilities 

reporting, $1.2 million per year for EPA, 

and $1.24 million for each of the 30 

states that were assumed to implement 

programs over the eight years of the 

analysis. EPA received many comments 

on the costs associated with the 

proposed electronic reporting 

provisions. Comments included 

concerns about the proposal’s 

assumptions related to the number of 

affected entities, the number of 

registered users per facility, the costs to 

state programs, and the costs of 

implementing standard formats. Several 

commenters expressed support for the 

analysis findings, concurring that 

electronic reporting will reduce their 

environmental reporting costs. EPA’s 

response to these comments is 

explained in the following section. 

Additional comments on the cost 

analysis and EPA’s responses can be 

found in the rulemaking docket, in the 

Response to Comments document. 

B. Final Rule Costs 

In response to comments received on 

the proposed rule, EPA conducted 

additional cost analyses to determine 

the impacts of this rule on regulated 

entities, states, tribes, and local 

governments, and EPA programs. In 

developing the analysis for this final 

rule, EPA relied heavily on existing 

sources of data that included: 

• EPA’s 2002 Government Paperwork 

Elimination Act (GPEA) Report to OMB; 

• Interviews with EPA programs, 

states, and nine industry representatives 

currently using CDX to report 

electronically; 

• EPA’s Information Collection 

Requests (ICRs); 

• EPA’s Envirofacts Warehouse and 

Facility Registry System; 

• Follow-up to comments received 

from twenty state and local government 

agencies and several major industry 

associations; and 

• Market research to assess trends of 

large and small companies using the 

Internet, costs of technology for 

electronic signature and data exchange 

formats, and other technical issues. 

Based on the additional analyses, EPA 

estimates that under this rule there will 

be a total cumulative cost savings to the 

Agency, over the period 2003 to 2012, 

ranging from $64.4 million to $75.4 

million, depending on the discount rate 

used. For those that adopt electronic 

reporting, EPA estimates a total 

cumulative cost burden to state and 

local governments under this rule, over 

the period 2003 to 2012, ranging from 

$57.2 million to $65.2 million annually, 

depending on the discount rate used. 

These costs result from the incremental 

burden to states to upgrade their 

receiving systems to meet the rule’s 

standards and apply for EPA approval of 

program modifications and revisions. 

The model does not consider the 

potential cost savings to state and local 

governments resulting from processing 

electronic submittals but believes the 

savings would likely offset these 

incremental costs. For facilities, EPA 

estimates a total cumulative cost during 

this period ranging from $41.6 million 

to $51.9 million, depending on the 

discount rate used. The net total 

cumulative cost of this rule, over the 

period 2003 to 2012, ranges from $34.4 

million to $41.7 million, depending on 

the discount rate used. 

59874 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

C. General changes to methodology and 

assumptions 

The research effort for the final rule 

differed from that conducted for the 

proposal in that it was much broader 

and involved far greater engagement 

with external stakeholders. EPA used 

this research to reevaluate assumptions 

made in the proposal and to refine the 

overall approach to the cost-benefit 

analysis. The process of reevaluating 

costs to regulated entities included: 

• Analyzing the GPEA report to 

determine the specific information 

collections identified as being suitable 

for electronic reporting and their 

implementation schedule; 

• Evaluating each information 

collection request for an understanding 

of the types of activities that would be 

eliminated (such as mailing paper 

forms) or reduced (manual data quality 

checks) through electronic reporting; 

• Interviewing trade associations, 

reviewing comments received, 

evaluating market trend research, and 

querying Envirofacts warehouse and 

Facility Registry System to establish an 

understanding of the numbers of 

potential facility representatives that 

would register for a particular program, 

the rate of electronic reporting growth in 

a program, the number of facilities using 

web forms or file exchanges, and the 

relative distribution of small to large 

businesses; and 

• Establishing an understanding of 

the time required by facilities to register 

with CDX and maintain a CDX account, 

through interviews with CDX registered 

users and the CDX hotline. 

The process of reevaluating costs and 

benefits to EPA, state, tribes, and local 

governments, included: 

• Meeting with EPA programs and 

state program counterparts to identify 

the broad range of EPA authorized 

programs and the types and number of 

agencies under each program; 

• Interviewing state and local 

agencies and their associations as 

follow-up to public comment to obtain 

an understanding of their current 

electronic reporting systems, long-term 

plans, and perceived impacts to their 

systems from this rule; 

• Evaluating current information 

technology expenditures of CDX and 

other program system development 

efforts, and general costs of EPA 

rulemakings with respect to federal 

costs and benefits. 

In preparing the CBA, EPA used a 

computer model to estimate the annual 

costs to EPA, state and local 

governments and regulated entities. To 

evaluate the costs and benefits of this 

rule, two scenarios were modeled: a 

‘‘Baseline’’ scenario in which EPA 

would enable electronic reporting 

through an approach other than 

CROMERR and a ‘‘To Be’’ scenario in 

which EPA enables electronic reporting 

under CROMERR. In comparing the 

cumulative costs of this rule, EPA notes 

that the ‘‘To Be’’ scenario would be a 

more efficient approach than the 

‘‘Baseline’’ scenario. Under the 

‘‘Baseline’’ scenario, EPA programs 

would be left to implement their own 

program-specific electronic reporting 

requirements and electronic document 

receiving systems. Also, under the 

‘‘Baseline’’ scenario, electronic 

reporting would be delayed, because 

EPA would have to generate separate 

rules and guidance to support programspecific electronic document receiving 

systems. Once these systems were 

established, reporting entities could 

conceivably be required to register 

under different rules and through 

different systems across EPA programs. 

Based on the new research, EPA 

revised assumptions about the costs 

associated with authorized programs 

and corresponding benefits to the 

reporting entities. In contrast to the 

proposal, EPA does not claim the costs 

associated in building electronic 

document receiving systems for 

authorized programs (state, tribe, and 

local) or the benefits for their reporting 

entities in using these systems. Since it 

is clear that authorized programs intend 

to proceed with electronic reporting on 

their own regardless of this rule, the 

analyses for the final rule looks at the 

incremental costs to electronic 

document receiving systems that would 

be developed absent this rule, in 

meeting the final rule’s requirements. 

Based on research and comments 

received on the proposal, EPA also 

revised the following key cost 

assumptions: 

• Increased costs for XML. EPA 

substantially increased the cost estimate 

of integrating an XML format into a 

facility’s environmental management 

system (from $4,000 to $10,000). 

• Increased number of registered 

users. EPA substantially increased the 

number of registrants (from 3 registrant/ 

facility to 6 registrants per facility) in 

large companies that would use CDX. 

• Broadened impacts of authorized 

programs. EPA substantially broadened 

the number of state, tribe, and local 

environmental agencies potentially 

impacted by the rule, to include health 

departments, county air boards, oil and 

gas agencies, and publicly-owned 

treatment works. 

VIII. Statutory and Executive Order 

Reviews 

A. Executive Order 12866 

Pursuant to the terms of Executive 

Order 12866 (58 FR 51735, October 4, 

1993), it has been determined that this 

rule is a ‘‘significant regulatory action’’

because it raises novel legal or policy 

issues. As such, this action was 

submitted to OMB for review. Changes 

made in response to OMB suggestions or 

recommendations are documented in 

the public record. 

For EPA, the average annual cost to 

implement and operate electronic 

reporting under this rule is estimated to 

be $60.94 million. The average annual 

cost to implement and operate 

electronic reporting in the absence of 

this rule (i.e., where EPA implements 

electronic reporting on a programspecific basis) is estimated to be $70.36 

million for EPA. The average annual 

cost savings to EPA under this rule is 

$8.42 million. The average annual cost 

to states, tribes, and local governments 

in initially upgrading their electronic 

receiving systems and obtaining EPA 

approval for appropriate program 

modification under the rule ranges from 

roughly $5,000 to $460,000, depending 

on the number of systems and extent of 

the upgrades needed. In addition, states, 

tribes, and local governments that 

upgrade their systems are expected to 

incur system maintenance costs 

averaging about $10,000 annually. 

These costs reflect solely the 

incremental costs resulting from the 

rule; they do not reflect the cost savings 

that states, tribes, and local governments 

will experience in implementing their 

receiving systems. EPA has not 

quantified these savings as part of its 

analysis. It should be noted that EPA 

expects today’s rule to produce a net 

cost savings for states, tribes, and local 

governments. However, it is not possible 

to provide an adequate year-by-year 

comparison of the costs of the two 

scenarios, because the Baseline Scenario 

anticipates a more gradual process of 

EPA approval for state, tribe, and local 

government electronic reporting 

systems, starting at a later point in time. 

The average annual cost to facilities to 

submit electronic reports to EPA in 

compliance with today’s rule ranges 

from $9 for those entities that choose 

simply to use a web browser to access 

CDX and fill out web forms, to $10,000 

per facility for those companies that 

wish to configure their environmental 

management systems to exchange data 

with CDX, using agreed-upon data 

exchange formats. 

In addition to the monetary benefits 

identified by the analysis, EPA also 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59875 

believes that there are many qualitative 

benefits that justify the initial costs 

associated with the rule. These benefits 

include: 

• Responding to federal requirements, 

such as GPEA, which, among other 

things, requires federal agencies to 

allow individuals or entities that deal 

with the agencies the option to submit 

information or transact with the agency 

electronically. This rule sets the legal 

framework for most major EPA 

initiatives implementing electronic 

environmental data exchanges with the 

various stakeholders. 

• Maintaining consistency with 

emerging industry commercial 

practices. The implementation of 

electronic government initiatives is a 

reflection of the rapid evolution of 

electronic commerce, which has 

occurred in industry since the 

expansion of the Internet and the World 

Wide Web (WWW), in the early 1990s. 

In many ways, EPA and state, tribe, and 

local environmental agencies’

implementations of electronic reporting 

under today’s rule will be more 

consistent with emerging practices and 

less burdensome to industry than paper 

reporting. 

• Providing sound environmental 

practice. Part of EPA’s mission is 

conserving environmental resources. 

The traditional paper-based reporting 

practices and processes consumes trees 

and other resources for printing, 

exchanging, reproducing, storing, and 

retrieving grants, permits, compliance 

reports, and supporting documents. 

• Fostering more rapid environmental 

compliance reporting. Organizations 

have become increasingly 

environmentally conscientious. This 

change stems both from a desire to be 

good corporate citizens and from fear of 

negative media reporting. Hence, 

organizations, especially large 

companies, are becoming increasingly 

interested in being able to demonstrate 

their environmental compliance. More 

rapid and accurate public posting of 

compliance data by environmental 

agencies is one way to help achieve this 

goal. 

• Simplifying facility reporting. 

Electronic reporting and EPA’s planned 

implementation support a single point 

of entry into agency systems, which will 

enhance facilities’ ability to locate 

appropriate regulations, obtain 

information, ask questions, obtain 

forms, and submit data. 

• Providing more accurate data. 

Replacing paper forms with electronic 

forms will result in more accurate data. 

Systems incorporating electronic forms 

can perform real time edit checks that 

will reduce the number of input errors. 

These checks can range from simple 

verification of valid date formats, to 

complex validations of proper 

nomenclature and limits of chemicals 

emitted into the environment. Improved 

data quality will also help reduce the 

time required for data correction and the 

effects of inaccurate reporting. 

• Making data more readily available. 

The process of creating, mailing, 

receiving, entering, verifying, and 

correcting paper reports consumes both 

resources and time. This delays the 

analysis of the data by EPA and 

authorized programs and its availability 

to decision makers and the public. 

• Provides the foundation for further 

process re-engineering. Moving data 

from a paper to an electronic system as 

early in the process as possible creates 

the foundation on which many workflow re-engineering initiatives can be 

constructed. 

B. Executive Order 13132 

Executive Order 13132, entitled 

‘‘Federalism’’ (64 FR 43255, August 10, 

1999), requires EPA to develop an 

accountable process to ensure 

‘‘meaningful and timely input by state 

and local officials in the development of 

regulatory policies that have federalism 

implications.’’ ‘‘Policies that have 

federalism implications’’ are defined in 

the Executive Order to include 

regulations that have ‘‘substantial direct 

effects on the states, on the relationship 

between the national government and 

the states, or on the distribution of 

power and responsibilities among the 

various levels of government.’’

This final rule does not have 

federalism implications. EPA has 

determined that the final rule will not 

have substantial direct effects on the 

states, on the relationship between the 

national government and the states, or 

on the distribution of power and 

responsibilities among the various 

levels of government, as specified in 

Executive Order 13132. The final rule 

will not require states to accept 

electronic reports. The effect of this rule 

will be to provide an electronic 

alternative to currently accepted 

methods of receiving regulatory reports 

on paper and to give the states the 

option of choosing to receive electronic 

submissions in satisfaction of reporting 

requirements under their authorized 

programs or continuing to require 

submissions on paper. 

Authorized states and local agencies 

that choose to receive electronic reports 

under this rule may incur expenses 

initially in developing systems or 

modifying existing systems to meet the 

standards in this rule. The average 

annual cost to state agencies in 

upgrading their electronic receiving 

systems and obtaining EPA program 

modification approval depends on the 

amount of effort required to adhere to 

the requirements of this rule. However, 

EPA estimates that for those states 

deploying systems that meet rule 

standards, each state will incur a cost of 

about $12,000 in obtaining EPA 

approval of its system. For a state where 

upgrades to its systems are needed to 

meet rule requirements, the costs can 

range up to $460,000, depending on the 

size and complexity of its systems and 

the extent of the upgrades needed. 

Maintenance costs for maintaining 

compliance with this rule will cost each 

state about $10,000 annually. These 

costs include both capital costs required 

for hardware and software upgrades, 

and labor costs incurred by state 

employees. EPA analyzed the most 

likely alternative scenario where, absent 

this rule, EPA programs would 

implement rules that would require 

states to seek program modifications on 

a program by program basis. It should be 

noted that these analyses do not 

quantify the cost savings that states will 

incur through offering electronic 

reporting options to their reporting 

entities. EPA believes these savings will 

greatly outweigh the costs of complying 

with the rule. Based on these analyses, 

EPA believes that although the final rule 

imposes some compliance costs on state 

and local governments, the costs for 

most states are marginal and will result 

in net benefits over the most likely 

alternative scenario. 

Over the last several years, EPA has 

provided substantial financial support 

to states to assist in upgrades to 

information technology systems. For 

example, in fiscal years 2002–2004, EPA 

provided approximately $65 million 

dollars to states, tribes, and territories 

through grants to support their efforts to 

establish EIEN. EPA intends to award 

additional grants for fiscal year 2005. 

EPA’s fiscal year 2006 budget includes 

$20 million for the EIEN Grant Program. 

States, tribes, and territories may apply 

for these grant funds to generally 

upgrade their EIEN capabilities, 

including improvements related to this 

rule, e.g., to improve data validity and 

user authentication procedures, as 

required by today’s final rule. 

Although Section 6 of Executive 

Order 13132 does not apply to this rule, 

EPA has welcomed the active 

participation of the states; on several 

separate occasions EPA has held 

substantial consultations with state and 

local officials in developing this rule. 

State participation has resulted in 

changes to the final rule, including the 

section 3.1000 approval process and 

59876 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

special provisions such as deferred 

compliance for existing systems. 

C. Paperwork Reduction Act 

OMB has approved the information 

collection requirements contained in 

this rule under the provisions of the 

Paperwork Reduction Act (PRA), 44 

U.S.C. 3501 et seq. and has assigned 

OMB control number 2025–0003. 

The ICR for this rule covers the 

registration information, which will be 

collected from individuals wishing to 

submit electronic reports to EPA on 

behalf of regulated facilities. The 

information will be used to establish the 

identity of that individual and the 

regulated entity he or she represents. 

This information will be used by EPA to 

register and provide individuals with 

the ability to access the EPA’s electronic 

document receiving system, CDX. In 

appropriate circumstances this 

information will also be used to issue an 

electronic signature to the registered 

individual. The ICR also covers 

activities incidental to electronic 

reporting (e.g., submittal of an electronic 

signature agreement to EPA as 

applicable). It should be noted that the 

submission of environmental reports in 

an electronic format to EPA and states, 

tribes, and local governments is 

voluntary for most examples of 

electronic reporting, and viewed as a 

service that EPA and its regulatory 

partners are providing to the regulated 

community. The rule allows reporting 

entities to submit reports and other 

information electronically, thereby 

streamlining and expediting the process 

for reporting. However, it should also be 

understood that this rule does set forth 

requirements for regulated entities that 

submit electronic reports directly to 

EPA and for states, tribes, and local 

governments that choose to implement 

electronic reporting under their 

authorized programs. EPA is issuing this 

rule on cross-media electronic reporting, 

in part, under the authority of GPEA, 

Public Law 105–277, which amends the 

PRA. 

In addition, the ICR covers state, tribe, 

and local government activities 

involved in upgrading their electronic 

receiving systems to satisfy the 

standards in the rule and in applying to 

EPA for approval of program 

modification. States, tribes, and local 

governments will undertake these 

activities only if they intend to collect 

information electronically under an EPA 

authorized program. 

The total annual reporting and 

recordkeeping burden this ICR estimates 

is 151,963 hours, which includes the 

tasks described above. It is expected that 

a respondent reporting directly to EPA 

will take on average ten minutes to 

register with CDX; however, if the 

respondent contacts the CDX help desk 

for assistance with CDX registration, on 

average the respondent will incur an 

additional six minutes. The average 

annual number of respondents 

registering with CDX is 19,434. It is 

further expected that 201,331 

respondents will report electronically to 

a state, tribe, or local government 

receiving system. Respondents reporting 

to EPA or state, tribe, or local 

governments may also incur an 

additional burden of 20 minutes to 

prepare, sign, and submit an electronic 

signature agreement. The average 

annual number of these respondents is 

177,009. In addition, the ICR estimates 

that 7,293 medium-sized and large 

companies will register local 

registration authorities (LRA) and incur 

an additional burden of 1 hour. This 

includes the time to prepare and submit 

LRA designation applications, collect 

and store subscriber agreements, and 

prepare and submit certification of 

receipt and secure storage. 

Finally, it is expected that a state, 

tribe, or local government would take 

between 210 and 330 hours to prepare 

and submit its program modification 

application to EPA. The average annual 

number of states applying to EPA is 

expected to be 15; the average annual 

number of tribes and local governments 

applying to EPA is expected to be 46. In 

addition, the ICR estimates $4,450,658 

in annual capital/start-up costs for 

states, tribes and local governments to 

upgrade their receiving systems. The 

ICR estimates $663,975 in annual 

operation and maintenance costs. This 

includes costs to registrants and state, 

tribes and local governments in 

submitting information to EPA. 

Public Burden Statement 

The public reporting burden is 

estimated to be 10 minutes for an 

individual that reports electronically to 

the CDX. This includes time for 

preparing the on-line application and 

calling the CDX help desk. 

The public reporting burden in this 

ICR is estimated to be 15 minutes for an 

individual that prepares and submits a 

subscriber agreement. 

The public reporting burden is 

estimated to be 30 minutes for a local 

registration authority. This includes 

time for preparing and submitting the 

certification of receipt and secure 

storage to EPA or state/local agency. 

The public reporting burden is 

estimated to range from 210 hours for a 

local government to 330 hours for a state 

seeking to implement an electronic 

receiving system. This includes time for 

preparing and submitting the program 

modification application to EPA. 

Burden means the total time, effort, or 

financial resources expended by persons 

to generate, maintain, retain, or disclose 

or provide information to or for a 

Federal agency. This includes the time 

needed to review instructions; develop, 

acquire, install, and utilize technology 

and systems for the purposes of 

collecting, validating, and verifying 

information, processing and 

maintaining information, and disclosing 

and providing information; adjust the 

existing ways to comply with any 

previously applicable instructions and 

requirements; train personnel to be able 

to respond to a collection of 

information; search data sources; 

complete and review the collection of 

information; and transmit or otherwise 

disclose the information. 

An agency may not conduct or 

sponsor, and a person is not required to 

respond to a collection of information 

unless it displays a currently valid OMB 

control number. The OMB control 

numbers for EPA’s regulations are listed 

in 40 CFR part 9 and 48 CFR chapter 15. 

In addition, EPA is amending the table 

in 40 CFR part 9 of currently approved 

OMB control numbers for various 

regulations to list the regulatory 

citations for the information 

requirements contained in this final 

rule. 

D. Regulatory Flexibility Act 

The Regulatory Flexibility Act (RFA), 

5 U.S.C. 601 et seq., generally requires 

an agency to prepare a regulatory 

flexibility analysis of any rule subject to 

notice and comment rulemaking 

requirements under the Administrative 

Procedure Act or any other statute 

unless the agency certifies that the rule 

will not have a significant economic 

impact on a substantial number of small 

entities. Small entities include small 

businesses, small organizations, and 

small governmental jurisdictions. 

For the purpose of assessing the 

impacts of today’s rule on small entities, 

small entity is defined as: (1) Small 

business as defined by the RFA and 

based on Small Business Administration 

(SBA) size standards; (2) a small 

governmental jurisdiction that is a 

government of a city, county, town, 

school district, or special district with a 

population of less then 50,000; and (3) 

a small organization that is any not-forprofit enterprise which is independently 

owned and operated and is not 

dominant in its field. 

After considering the economic 

impacts of today’s final rule on small 

entities, the Agency certifies, pursuant 

to section 605(b) of the RFA, that this 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59877 

action will not have a significant 

economic impact on a substantial 

number of small entities. Courts have 

interpreted the RFA to require a 

regulatory flexibility analysis only when 

small entities will be subject to the 

requirements of the rule. See Motor and 

Equip. Mfrs. Ass’n v. Nichols, 142 F.3d 

449 (D.C. Cir. 1998); United Distribution 

Cos. v. FERC, 88 F.3d 1105, 1170 (D.C. 

Cir. 1996); Mid-Tex Elec. Co-op, Inc. v. 

FERC, 773 F.2d 327, 342 (D.C. Cir. 1985) 

(agency’s certification need only 

consider the rule’s impact on entities 

subject to the rule). This final rule 

would not establish any new direct 

requirements applicable to small 

entities. States that are directly 

regulated in this rulemaking are not 

small entities. 

This rule provides for EPA review and 

approval of authorized state, tribe, and 

local government programs that decide 

to provide for electronic reporting. This 

rule includes performance standards 

against which a state’s, tribe’s, or local 

government’s electronic document 

receiving system will be evaluated 

before EPA will approve changes to the 

delegated, authorized, or approved 

program to provide electronic reporting, 

and establishes a streamlined process 

that states, tribes, and local governments 

can use to seek and obtain such 

approvals. The rule also includes 

special provisions for existing state 

electronic reporting systems in place at 

the time of publication of this rule. 

Currently, entities that choose to 

submit electronic documents directly to 

EPA submit documents to a centralized 

Agency-wide electronic documentreceiving system, called the CDX, or to 

alternative systems designated by the 

Administrator. This rule does not 

change those systems. In addition, 

today’s rule, does not require the 

submission of electronic documents in 

lieu of paper documents. 

Because there is no requirement to 

adopt electronic reporting, EPA has 

determined that small local 

governments will not be directly 

impacted by this rule. Nonetheless, EPA 

also considered the possible impacts of 

this rule to determine whether small 

local governments could potentially be 

subject to the provisions of § 3.1000, 

which would require these programs to 

seek EPA approval for their electronic 

document receiving systems if they 

choose to provide electronic reporting. 

EPA reviewed its programs and 

conducted follow-up to comments 

received from industry, state, and local 

government associations to determine 

possible impacts to small local 

jurisdictions. Based on its review, EPA 

concluded that the only small 

government jurisdictions possibly 

subject to the rule are those with 

Publicly-Owned Treatment Works 

(POTWs). Only POTWs choosing to 

deploy electronic document receiving 

systems would be subject to today’s 

rule. Through analysis and direct 

discussions with municipal POTWs and 

trade associations, EPA did not identify 

any such small government jurisdictions 

planning to deploy electronic reporting 

systems. 

Although not required by the RFA, 

(See Michigan v. EPA, 213 F.3d 663, 

668–69 (D.C. Cir., 2000), cert. den. 121 

S.Ct. 225, 149 L.Ed.2d 135 (2001)), as a 

part of the analysis prepared under 

Executive Order 12866, EPA also 

considered the costs to small entities 

that are indirect reporters to authorized 

state, tribal, and local government 

programs. For this final rule, EPA 

prepared a cost/benefit analysis to 

assess the economic impact of 

CROMERR, which can be found in the 

docket for this rule. 

Although this rule will not have a 

significant economic impact on a 

substantial number of small entities, the 

Agency nonetheless consulted with 

small entities as well as organizations 

such as the Small Business 

Administration (SBA). We made several 

changes to the rule based upon these 

discussions. 

E. Unfunded Mandates Reform Act 

Title II of the Unfunded Mandates 

Reform Act of 1995 (UMRA), Public 

Law 104–4, establishes requirements for 

federal agencies to assess the effects of 

their regulatory actions on states, tribes, 

and local governments and the private 

sector. Under section 202 of UMRA, 

EPA must prepare a written statement, 

including a cost-benefit analysis, for 

proposed and final rules with ‘‘Federal 

mandates’’ that may result in 

expenditures to states, tribes, and local 

governments, in the aggregate, or to the 

private sector, of $100 million or more 

in any one year. Before promulgating a 

rule for which a written statement is 

needed, section 205 of the UMRA 

generally requires EPA to identify and 

consider a reasonable number of 

regulatory alternatives and adopt the 

least costly, most cost-effective or least 

burdensome alternative that achieves 

the objectives of the rule. The 

provisions of section 205 do not apply 

when they are inconsistent with 

applicable law. Moreover, section 205 

allows EPA to adopt an alternative other 

than the least costly, most cost-effective 

or least burdensome alternative if the 

Administrator publishes with the final 

rule an explanation why that alternative 

was not adopted. 

Before EPA establishes any regulatory 

requirements that may significantly or 

uniquely affect small governments, 

including tribes, it must have developed 

under section 203 of UMRA a smallgovernment agency plan. The plan must 

provide for notifying potentially 

affected small governments, enabling 

officials of affected small governments 

to have meaningful and timely input 

into the development of EPA regulatory 

proposals with significant Federal 

intergovernmental mandates. The plan 

must also provide for informing, 

educating, and advising small 

governments on compliance with the 

regulatory requirements. 

As described in section VIII.D. of this 

Preamble, above, EPA also evaluated the 

possible impacts of this rule to small 

governments. In particular, EPA was 

concerned that small governments could 

potentially be subject to the provisions 

of § 3.1000, which would require these 

programs to seek EPA approval for the 

electronic document receiving systems. 

EPA reviewed its programs, and also 

conducted follow-up to comments from 

industry, state, and local government 

associations to determine possible 

impacts to small local governments. As 

a result of this review, EPA concluded 

that small local governments would not 

be adversely impacted by the provisions 

of § 3.1000 this rule. 

The Agency has determined that this 

rule does not contain a Federal mandate 

that may result in expenditures of $100 

million or more for states, tribes, and 

local governments, in the aggregate, or 

the private sector in any one year. Thus, 

today’s rule is not subject to the 

requirements in sections 202 and 205 of 

UMRA. The Agency has determined that 

this rule contains no regulatory 

requirements that might significantly or 

uniquely affect small governments and 

thus this rule is not subject to the 

requirements in section 202 of UMRA. 

F. National Technology Transfer and 

Advancement Act 

Section 12(d) of the National 

Technology Transfer and Advancement 

Act of 1995 (NTTAA), Public Law 104–

113, section 12(d) (15 U.S.C. 272 note) 

directs EPA to use voluntary consensus 

standards in its regulatory activities 

unless to do so would be inconsistent 

with applicable law or otherwise 

impractical. Voluntary consensus 

standards are technical standards (e.g., 

materials specifications, test methods, 

sampling procedures, and business 

practices) that are developed or adopted 

by voluntary consensus standards 

bodies. The NTTAA directs EPA to 

provide Congress, through OMB, with 

explanations when the Agency decides 

59878 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

not to use available and applicable 

voluntary consensus standards. 

The consensus standards relevant to 

an electronic reporting rule are 

primarily technical standards that 

specify file formats for the electronic 

exchange of data, telecommunications 

network protocols, and electronic 

signature technologies and formats. EPA 

is not setting requirements for electronic 

reporting at the level of specificity 

addressed by such formats, protocols 

and technologies, so consensus 

standards are not directly applicable to 

today’s rule. For example, the final rule 

does not stipulate data exchange 

formats, does not specify electronic 

signature technologies, and does not 

address telecommunications issues. At 

the same time, there is nothing in 

today’s rule that is incompatible with 

these standards, and in implementing 

electronic reporting under this rule EPA 

is adopting standards-based approaches 

to electronic data exchange. 

In the preamble to the proposed rule, 

EPA described its initial plans to 

implement a number of standards-based 

approaches to electronic reporting, 

including electronic data exchange 

formats based upon the ANSI 

Accredited Standards Committee’s 

(ASC) X12 for Electronic Data 

Interchange or EDI. That preamble also 

discussed EPA’s interest in exploring 

the use of Internet data exchange 

formats based on XML, then under 

development by the World Wide Web 

Consortium (W3C). As a part of the 

preamble discussion, EPA solicited 

comment on these planned standardsbased electronic reporting 

implementations. In response, EPA 

received considerable feedback both 

from states and from industry indicating 

a trend in the direction of XML, and 

away from the deployment of ANSI ASC 

X12 standards. In any event, CDX now 

looks to XML to provide the formats for 

its Internet data exchanges. EPA 

currently supports multi-agency 

Integrated Project Teams to develop 

XML formats and intends to use 

standardized formats for this purpose to 

the extent that they are available. In 

addition, EPA currently registers XML 

formats in its System of Registries to 

facilitate easy access to these formats for 

partners wishing to exchange data. EPA 

is attempting to make use of applicable 

standards-setting work being done by 

several organizations, including the 

Electronic Business XML (ebXML), the 

Organization for the Advancement of 

Structured Information Standards 

(OASIS), and, internationally, the 

United Nation’s Center for 

Administration, Commerce, and 

Transport (UN/CEFACT) Forum. In any 

event, today’s rule is compatible with 

any of these current standards-based 

approaches to electronic reporting, but 

the rule itself does not set requirements 

at the level of detail that such standards 

address. 

G. Executive Order 13045 

Executive Order 13045, Protection of 

Children from Environmental Health 

Risks and Safety Risks (62 FR 19885, 

April 23, 1997) applies to any rule that 

EPA determines (1) ‘‘economically 

significant’’ as defined under Executive 

Order 12866 and (2) concerns an 

environmental health or safety risk that 

EPA has reason to believe may have a 

disproportionate effect on children. EPA 

interprets Executive Order 13045 as 

encompassing only those regulatory 

actions that are risk-based or healthbased, such that the analysis required 

under Section 5–501 of the Executive 

Order has the potential to influence the 

regulation. 

This rule is not subject to Executive 

Order 13045 because it is not an 

economically significant action as 

defined by Executive Order 12866 and 

it does not involve decisions regarding 

environmental health or safety risks. 

This rule contains general performance 

standards for the submission of 

environmental data electronically. 

H. Executive Order 13175 

Executive Order 13175, entitled, 

‘‘Consultation and Coordination with 

Indian Tribal Governments’’ (65 FR 

67249, November 6, 2000), requires EPA 

to develop an accountable process to 

ensure ‘‘meaningful and timely input by 

tribal officials in the development of 

regulatory policies that have tribal 

implications.’’ ‘‘Policies that have tribal 

implications’’ are defined in the 

Executive Order to include regulations 

that have ‘‘substantial direct effects on 

one or more Indian tribes, on the 

relationship between the Federal 

Government and the Indian tribes, or on 

the distribution of power and 

responsibilities between the Federal 

Government and Indian tribes.’’

This rule does not have tribal 

implications, as specified in Executive 

Order 13175, and therefore consultation 

under the Order is not required. It will 

not have substantial direct effects on 

tribes, on the relationship between the 

federal government and Indian tribes, or 

on the distribution of power and 

responsibilities between the federal 

government and Indian tribes, as 

specified in Executive Order 13175. 

This action does not require Indian 

tribes to accept electronic reports. The 

effect of this rule is to provide 

additional regulatory flexibility to 

Indian tribes by giving them the 

opportunity to submit electronic reports 

to EPA in satisfaction of EPA reporting 

requirements and by allowing them to 

implement electronic reporting under 

their authorized programs. 

I. Executive Order 13211 (Energy 

Effects) 

This rule is not a ‘‘significant energy 

action’’ as defined in Executive Order 

13211, ‘‘Actions Concerning Regulations 

That Significantly Affect Energy Supply, 

Distribution, or Use’’ (66 FR 28355, May 

22, 2001) because it is not likely to have 

a significant adverse affect on the 

supply, distribution, or use of energy. 

EPA has concluded that this rule is not 

likely to have any adverse energy 

effects. 

J. Congressional Review Act 

The Congressional Review Act, 5 

U.S.C. 801 et seq., as added by the Small 

Business Regulatory Enforcement 

Fairness Act of 1996, generally provides 

that before a rule may take effect, the 

agency promulgating the rule must 

submit a rule report, which includes a 

copy of the rule, to each House of the 

Congress and to the Comptroller General 

of the United States. EPA will submit a 

report containing this rule and other 

required information to the U.S. Senate, 

the U.S. House of Representatives, and 

the Comptroller General of the United 

States prior to publication of the rule in 

the Federal Register. A major rule 

cannot take effect until 60 days after it 

is published in the Federal Register. 

This action is not a ‘‘major rule’’ as 

defined by 5 U.S.C. 804(2). This rule 

will become effective on January 11, 

2006. 

List of Subjects 

40 CFR Part 3 

Environmental protection, Conflict of 

interests, Electronic records, Electronic 

reporting requirements, Electronic 

reports, Intergovernmental relations. 

40 CFR Part 9 

Environmental protection, Electronic 

records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Reporting 

and recordkeeping requirements. 

40 CFR Part 51 

Environmental protection, 

Administrative practice and procedure, 

Air pollution control, Carbon monoxide, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Lead, 

Nitrogen dioxide, Ozone, Particulate 

matter, Reporting and recordkeeping 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59879 

requirements, Sulfur oxides, Volatile 

organic compounds. 

40 CFR Part 60 

Environmental protection, 

Administrative practice and procedure, 

Air pollution control, Aluminum, 

Ammonium sulfate plants, Batteries, 

Beverages, Carbon monoxide, Cement 

industry, Coal, Copper, Dry cleaners, 

Electric power plants, Electronic 

records, Electronic reporting 

requirements, Electronic reports, 

Fertilizers, Fluoride, Gasoline, Glass 

and glass products, Grains, Graphic arts 

industry, Heaters, Household 

appliances, Insulation, 

Intergovernmental relations, Iron, 

Labeling, Lead, Lime, Metallic and 

nonmetallic mineral processing plants, 

Metals, Motor vehicles, Natural gas, 

Nitric acid plants, Nitrogen dioxide, 

Paper and paper products industry, 

Particulate matter, Paving and roofing 

materials, Petroleum, Phosphate, 

Plastics materials and synthetics, 

Polymers, Reporting and recordkeeping 

requirements, Sewage disposal, Steel, 

Sulfur oxides, Sulfuric acid plants, 

Tires, Urethane, Vinyl, Volatile organic 

compounds, Waste treatment and 

disposal, Zinc. 

40 CFR Part 63 

Environmental protection, Air 

pollution control, Electronic records, 

Electronic reporting requirements, 

Electronic reports, Hazardous 

substances, Intergovernmental relations, 

Reporting and recordkeeping 

requirements. 

40 CFR Part 69 

Environmental protection, Air 

pollution control, Electronic records, 

Electronic reporting requirements, 

Electronic reports, Guam, 

Intergovernmental relations. 

40 CFR Part 70 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations. 

40 CFR Part 71 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations. 

40 CFR Part 123 

Environmental protection, 

Administrative practice and procedure, 

Confidential business information, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Hazardous substances, Indians-lands, 

Intergovernmental relations, Penalties, 

Reporting and recordkeeping 

requirements, Water pollution control. 

40 CFR Part 142 

Environmental protection, 

Administrative practice and procedure, 

Chemicals, Electronic records, 

Electronic reporting requirements, 

Electronic reports, Indians-lands, 

Intergovernmental relations, Radiation 

protection, Reporting and recordkeeping 

requirements, Water supply. 

40 CFR Part 145 

Environmental protection, 

Confidential business information, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Indians-lands, Intergovernmental 

relations, Penalties, Reporting and 

recordkeeping requirements, Water 

supply. 

40 CFR Part 162 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Pesticides 

and pests, Reporting and recordkeeping 

requirements, State registration of 

pesticide products. 

40 CFR Part 233 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Penalties, 

Reporting and recordkeeping 

requirements, Water pollution control. 

40 CFR Part 257 

Environmental protection, Electronic 

records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Waste 

treatment and disposal. 

40 CFR Part 258 

Environmental protection, Electronic 

records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Reporting 

and recordkeeping requirements, Waste 

treatment and disposal, Water pollution 

control. 

40 CFR Part 271 

Environmental protection, 

Administrative practice and procedure, 

Confidential business information, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Hazardous materials transportation, 

Hazardous waste, Indians-lands, 

Intergovernmental relations, Penalties, 

Reporting and recordkeeping 

requirements, Water pollution control, 

Water supply. 

40 CFR Part 281 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Hazardous substances, Insurance, 

Intergovernmental relations, Oil 

pollution, Reporting and recordkeeping 

requirements, Surety bonds, Water 

pollution control, Water supply. 

40 CFR Part 403 

Environmental protection, 

Confidential business information, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Reporting 

and recordkeeping requirements, Waste 

treatment and disposal, Water pollution 

control. 

40 CFR Part 501 

Environmental protection, 

Administrative practice and procedure, 

Electronic records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Penalties, 

Reporting and recordkeeping 

requirements, Sewage disposal. 

40 CFR Part 745 

Environmental protection, Electronic 

records, Electronic reporting 

requirements, Electronic reports, 

Intergovernmental relations, Hazardous 

substances, Lead poisoning, Reporting 

and recordkeeping requirements. 

40 CFR Part 763 

Environmental protection, 

Administrative practice and procedure, 

Asbestos, Electronic records, Electronic 

reporting requirements, Electronic 

reports, Hazardous substances, Imports, 

Intergovernmental relations, Reporting 

and recordkeeping requirements. 

Dated: September 22, 2005. 

Stephen L. Johnson, 

Administrator. 

■ Therefore, Title 40 Chapter I of the 

Code of Federal Regulations is amended 

by adding a new Part 3, and amending 

parts 9, 51, 60, 63, 69, 70, 71, 123, 142, 

145, 162, 233, 257, 258, 271, 281, 403, 

501, 745, and 763 to read as follows: 

PART 3—CROSS-MEDIA ELECTRONIC 

REPORTING 

Subpart A—General Provisions 

Sec. 

3.1 Who does this part apply to? 

3.2 How does this part provide for 

electronic reporting? 

3.3 What definitions are applicable to this 

part? 

59880 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

3.4 How does this part affect enforcement 

and compliance provisions of Title 40? 

Subpart B—Electronic Reporting to EPA 

3.10 What are the requirements for 

electronic reporting to EPA? 

3.20 How will EPA provide notice of 

changes to the Central Data Exchange? 

Subpart C—[Reserved] 

Subpart D—Electronic Reporting under 

EPA-Authorized State, Tribe, and Local 

Programs 

3.1000 How does a state, tribe, or local 

government revise or modify its 

authorized program to allow electronic 

reporting? 

3.2000 What are the requirements 

authorized state, tribe, and local 

programs’ reporting systems must meet? 

Authority: 7 U.S.C. 136 to 136y; 15 U.S.C. 

2601 to 2692; 33 U.S.C. 1251 to 1387; 33 

U.S.C. 1401 to 1445; 33 U.S.C. 2701 to 2761; 

42 U.S.C. 300f to 300j–26; 42 U.S.C. 4852d; 

42 U.S.C. 6901–6992k; 42 U.S.C. 7401 to 

7671q; 42 U.S.C. 9601 to 9675; 42 U.S.C. 

11001 to 11050; 15 U.S.C. 7001; 44 U.S.C. 

3504 to 3506. 

Subpart A—General Provisions 

§ 3.1 Who does this part apply to? 

(a) This part applies to: 

(1) Persons who submit reports or 

other documents to EPA to satisfy 

requirements under Title 40 of the Code 

of Federal Regulations (CFR); and 

(2) States, tribes, and local 

governments administering or seeking to 

administer authorized programs under 

Title 40 of the CFR. 

(b) This part does not apply to: 

(1) Documents submitted via facsimile 

in satisfaction of reporting requirements 

as permitted under other parts of Title 

40 or under authorized programs; or 

(2) Electronic documents submitted 

via magnetic or optical media such as 

diskette, compact disc, digital video 

disc, or tape in satisfaction of reporting 

requirements, as permitted under other 

parts of Title 40 or under authorized 

programs. 

(c) This part does not apply to any 

data transfers between EPA and states, 

tribes, or local governments as a part of 

their authorized programs or as a part of 

administrative arrangements between 

states, tribes, or local governments and 

EPA to share data. 

§ 3.2 How does this part provide for 

electronic reporting? 

(a) Electronic reporting to EPA. Except 

as provided in § 3.1(b), any person who 

is required under Title 40 to create and 

submit or otherwise provide a document 

to EPA may satisfy this requirement 

with an electronic document, in lieu of 

a paper document, provided that: 

(1) He or she satisfies the 

requirements of § 3.10; and 

(2) EPA has first published a notice in 

the Federal Register announcing that 

EPA is prepared to receive, in electronic 

form, documents required or permitted 

by the identified part or subpart of Title 

40. 

(b) Electronic reporting under an EPAauthorized state, tribe, or local program. 

(1) An authorized program may allow 

any document submission requirement 

under that program to be satisfied with 

an electronic document provided that 

the state, tribe, or local government 

seeks and obtains revision or 

modification of that program in 

accordance with § 3.1000 and also meets 

the requirements of § 3.2000 for such 

electronic reporting. 

(2) A state, tribe, or local government 

that is applying for initial delegation, 

authorization, or approval to administer 

a federal program or a program in lieu 

of the federal program, and that will 

allow document submission 

requirements under the program to be 

satisfied with an electronic document, 

must use the procedures for obtaining 

delegation, authorization, or approval 

under the relevant part of Title 40 and 

may not use the procedures set forth in 

§ 3.1000; but the application must 

contain the information required by 

§ 3.1000(b)(1) and the state, tribe, or 

local government must meet the 

requirements of § 3.2000. 

(c) Limitations. This part does not 

require submission of electronic 

documents in lieu of paper. This part 

confers no right or privilege to submit 

data electronically and does not obligate 

EPA, states, tribes, or local governments 

to accept electronic documents. 

§ 3.3 What definitions are applicable to 

this part? 

The definitions set forth in this 

section apply when used in this part. 

Acknowledgment means a 

confirmation of electronic document 

receipt. 

Administrator means the 

Administrator of the EPA. 

Agency means the EPA or a state, 

tribe, or local government that 

administers or seeks to administer an 

authorized program. 

Agreement collection certification 

means a signed statement by which a 

local registration authority certifies that 

a subscriber agreement has been 

received from a registrant; the 

agreement has been stored in a manner 

that prevents unauthorized access to 

these agreements by anyone other than 

the local registration authority; and the 

local registration authority has no basis 

to believe that any of the collected 

agreements have been tampered with or 

prematurely destroyed. 

Authorized program means a Federal 

program that EPA has delegated, 

authorized, or approved a state, tribe, or 

local government to administer, or a 

program that EPA has delegated, 

authorized, or approved a state, tribe or 

local government to administer in lieu 

of a Federal program, under other 

provisions of Title 40 and such 

delegation, authorization, or approval 

has not been withdrawn or expired. 

Central Data Exchange means EPA’s 

centralized electronic document 

receiving system, or its successors, 

including associated instructions for 

submitting electronic documents. 

Chief Information Officer means the 

EPA official assigned the functions 

described in section 5125 of the Clinger 

Cohen Act (Pub. L. 104–106). 

Copy of record means a true and 

correct copy of an electronic document 

received by an electronic document 

receiving system, which copy can be 

viewed in a human-readable format that 

clearly and accurately associates all the 

information provided in the electronic 

document with descriptions or labeling 

of the information. A copy of record 

includes: 

(1) All electronic signatures contained 

in or logically associated with that 

document; 

(2) The date and time of receipt; and 

(3) Any other information used to 

record the meaning of the document or 

the circumstances of its receipt. 

Disinterested individual means an 

individual who is not connected with 

the person in whose name the electronic 

signature device is issued. A 

disinterested individual is not any of the 

following: The person’s employer or 

employer’s corporate parent, subsidiary, 

or affiliate; the person’s contracting 

agent; member of the person’s 

household; or relative with whom the 

person has a personal relationship. 

Electronic document means any 

information in digital form that is 

conveyed to an agency or third-party, 

where ‘‘information’’ may include data, 

text, sounds, codes, computer programs, 

software, or databases. ‘‘Data,’’ in this 

context, refers to a delimited set of data 

elements, each of which consists of a 

content or value together with an 

understanding of what the content or 

value means; where the electronic 

document includes data, this 

understanding of what the data element 

content or value means must be 

explicitly included in the electronic 

document itself or else be readily 

available to the electronic document 

recipient. 

Electronic document receiving system 

means any set of apparatus, procedures, 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59881 

software, records, or documentation 

used to receive electronic documents. 

Electronic signature means any 

information in digital form that is 

included in or logically associated with 

an electronic document for the purpose 

of expressing the same meaning and 

intention as would a handwritten 

signature if affixed to an equivalent 

paper document with the same 

reference to the same content. The 

electronic document bears or has on it 

an electronic signature where it 

includes or has logically associated with 

it such information. 

Electronic signature agreement means 

an agreement signed by an individual 

with respect to an electronic signature 

device that the individual will use to 

create his or her electronic signatures 

requiring such individual to protect the 

electronic signature device from 

compromise; to promptly report to the 

agency or agencies relying on the 

electronic signatures created any 

evidence discovered that the device has 

been compromised; and to be held as 

legally bound, obligated, or responsible 

by the electronic signatures created as 

by a handwritten signature. 

Electronic signature device means a 

code or other mechanism that is used to 

create electronic signatures. Where the 

device is used to create an individual’s 

electronic signature, then the code or 

mechanism must be unique to that 

individual at the time the signature is 

created and he or she must be uniquely 

entitled to use it. The device is 

compromised if the code or mechanism 

is available for use by any other person. 

EPA means the United States 

Environmental Protection Agency. 

Existing electronic document 

receiving system means an electronic 

document receiving system that is being 

used to receive electronic documents in 

lieu of paper to satisfy requirements 

under an authorized program on 

October 13, 2005 or the system, if not 

in use, has been substantially developed 

on or before that date as evidenced by 

the establishment of system services or 

specifications by contract or other 

binding agreement. 

Federal program means any program 

administered by EPA under any other 

provision of Title 40. 

Federal reporting requirement means 

a requirement to report information 

directly to EPA under any other 

provision of Title 40. 

Handwritten signature means the 

scripted name or legal mark of an 

individual, handwritten by that 

individual with a marking-or writinginstrument such as a pen or stylus and 

executed or adopted with the present 

intention to authenticate a writing in a 

permanent form, where ‘‘a writing’’

means any intentional recording of 

words in a visual form, whether in the 

form of handwriting, printing, 

typewriting, or any other tangible form. 

The physical instance of the scripted 

name or mark so created constitutes the 

handwritten signature. The scripted 

name or legal mark, while 

conventionally applied to paper, may 

also be applied to other media. 

Information or objects of independent 

origin means data or items that originate 

from a disinterested individual or are 

forensic evidence of a unique, 

immutable trait which is (and may at 

any time be) attributed to the individual 

in whose name the device is issued. 

Local registration authority means an 

individual who is authorized by a state, 

tribe, or local government to issue an 

agreement collection certification, 

whose identity has been established by 

notarized affidavit, and who is 

authorized in writing by a regulated 

entity to issue agreement collection 

certifications on its behalf. 

Priority reports means the reports 

listed in Appendix 1 to part 3. 

Subscriber agreement means an 

electronic signature agreement signed 

by an individual with a handwritten 

signature. This agreement must be 

stored until five years after the 

associated electronic signature device 

has been deactivated. 

Transmit means to successfully and 

accurately convey an electronic 

document so that it is received by the 

intended recipient in a format that can 

be processed by the electronic 

document receiving system. 

Valid electronic signature means an 

electronic signature on an electronic 

document that has been created with an 

electronic signature device that the 

identified signatory is uniquely entitled 

to use for signing that document, where 

this device has not been compromised, 

and where the signatory is an individual 

who is authorized to sign the document 

by virtue of his or her legal status and/ 

or his or her relationship to the entity 

on whose behalf the signature is 

executed. 

§ 3.4 How does this part affect 

enforcement and compliance provisions of 

Title 40? 

(a) A person is subject to any 

applicable federal civil, criminal, or 

other penalties and remedies for failure 

to comply with a federal reporting 

requirement if the person submits an 

electronic document to EPA under this 

part that fails to comply with the 

provisions of § 3.10. 

(b) A person is subject to any 

applicable federal civil, criminal, or 

other penalties or remedies for failure to 

comply with a State, tribe, or local 

reporting requirement if the person 

submits an electronic document to a 

State, tribe, or local government under 

an authorized program and fails to 

comply with the applicable provisions 

for electronic reporting. 

(c) Where an electronic document 

submitted to satisfy a federal or 

authorized program reporting 

requirement bears an electronic 

signature, the electronic signature 

legally binds, obligates, and makes the 

signatory responsible, to the same extent 

as the signatory’s handwritten signature 

would on a paper document submitted 

to satisfy the same federal or authorized 

program reporting requirement. 

(d) Proof that a particular signature 

device was used to create an electronic 

signature will suffice to establish that 

the individual uniquely entitled to use 

the device did so with the intent to sign 

the electronic document and give it 

effect. 

(e) Nothing in this part limits the use 

of electronic documents or information 

derived from electronic documents as 

evidence in enforcement or other 

proceedings. 

Subpart B—Electronic Reporting to 

EPA 

§ 3.10 What are the requirements for 

electronic reporting to EPA? 

(a) A person may use an electronic 

document to satisfy a federal reporting 

requirement or otherwise substitute for 

a paper document or submission 

permitted or required under other 

provisions of Title 40 only if: 

(1) The person transmits the 

electronic document to EPA’s Central 

Data Exchange, or to another EPA 

electronic document receiving system 

that the Administrator may designate for 

the receipt of specified submissions, 

complying with the system’s 

requirements for submission; and 

(2) The electronic document bears all 

valid electronic signatures that are 

required under paragraph (b) of this 

section. 

(b) An electronic document must bear 

the valid electronic signature of a 

signatory if that signatory would be 

required under Title 40 to sign the paper 

document for which the electronic 

document substitutes, unless EPA 

announces special provisions to accept 

a handwritten signature on a separate 

paper submission and the signatory 

provides that handwritten signature. 

§ 3.20 How will EPA provide notice of 

changes to the Central Data Exchange? 

(a) Except as provided under 

paragraph (b) of this section, whenever 

59882 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

EPA plans to change Central Data 

Exchange hardware or software in ways 

that would affect the transmission 

process, EPA will provide notice as 

follows: 

(1) Significant changes to CDX: Where 

the equipment, software, or services 

needed to transmit electronic 

documents to the Central Data Exchange 

would be changed significantly, EPA 

will provide public notice and seek 

comment on the change and the 

proposed implementation schedule 

through the Federal Register; 

(2) Other changes to CDX: EPA will 

provide notice of other changes to 

Central Data Exchange users at least 

sixty (60) days in advance of 

implementation. 

(3) De minimis or transparent changes 

to CDX: For de minimis or transparent 

changes that have minimal or no impact 

on the transmission process, EPA may 

provide notice if appropriate on a caseby-case basis. 

(b) Emergency changes to CDX: Any 

change which EPA’s Chief Information 

Officer or his or her designee 

determines is needed to ensure the 

security and integrity of the Central Data 

Exchange is exempt from the provisions 

of paragraph (a) of this section. 

However, to the extent consistent with 

ensuring the security and integrity of 

the system, EPA will provide notice for 

any change other than de minimis or 

transparent changes to the Central Data 

Exchange. 

Subpart C—[Reserved] 

Subpart D—Electronic Reporting 

Under EPA-Authorized State, Tribe, 

and Local Programs 

§ 3.1000 How does a state, tribe, or local 

government revise or modify its authorized 

program to allow electronic reporting? 

(a) A state, tribe, or local government 

that receives or plans to begin receiving 

electronic documents in lieu of paper 

documents to satisfy requirements 

under an authorized program must 

revise or modify such authorized 

program to ensure that it meets the 

requirements of this part. 

(1) General procedures for program 

modification or revision: To revise or 

modify an authorized program to meet 

the requirements of this part, a state, 

tribe, or local government must submit 

an application that complies with 

paragraph (b)(1) of this section and must 

follow either the applicable procedures 

for program revision or modification in 

other parts of Title 40, or, at the 

applicant’s option, the procedures 

provided in paragraphs (b) through (e) 

of this section. 

(2) Programs planning to receive 

electronic documents under an 

authorized program: A state, tribe, or 

local government that does not have an 

existing electronic document receiving 

system for an authorized program must 

receive EPA approval of revisions or 

modifications to such program in 

compliance with paragraph (a)(1) of this 

section before the program may receive 

electronic documents in lieu of paper 

documents to satisfy program 

requirements. 

(3) Programs already receiving 

electronic documents under an 

authorized program: A state, tribe, or 

local government with an existing 

electronic document receiving system 

for an authorized program must submit 

an application to revise or modify such 

authorized program in compliance with 

paragraph (a)(1) of this section no later 

than October 13, 2007. On a case-bycase basis, this deadline may be 

extended by the Administrator, upon 

request of the state, tribe, or local 

government, where the Administrator 

determines that the state, tribe, or local 

government needs additional time to 

make legislative or regulatory changes to 

meet the requirements of this part. 

(4) Programs with approved electronic 

document receiving systems: An 

authorized program that has EPA’s 

approval to accept electronic documents 

in lieu of paper documents must keep 

EPA apprised of those changes to laws, 

policies, or the electronic document 

receiving systems that have the 

potential to affect program compliance 

with § 3.2000. Where the Administrator 

determines that such changes require 

EPA review and approval, EPA may 

request that the state, tribe, or local 

government submit an application for 

program revision or modification; 

additionally, a state, tribe, or local 

government on its own initiative may 

submit an application for program 

revision or modification respecting their 

receipt of electronic documents. Such 

applications must comply with 

paragraph (a)(1) of this section. 

(5) Restrictions on the use of 

procedures in this section: The 

procedures provided in paragraphs (b) 

through (e) of this section may only be 

used for revising or modifying an 

authorized program to provide for 

electronic reporting and for subsequent 

revisions or modifications to the 

electronic reporting elements of an 

authorized program as provided under 

paragraph (a)(4) of this section. 

(b)(1) To obtain EPA approval of 

program revisions or modifications 

using procedures provided under this 

section, a state, tribe, or local 

government must submit an application 

to the Administrator that includes the 

following elements: 

(i) A certification that the state, tribe, 

or local government has sufficient legal 

authority provided by lawfully enacted 

or promulgated statutes or regulations 

that are in full force and effect on the 

date of the certification to implement 

the electronic reporting component of 

its authorized programs covered by the 

application in conformance with 

§ 3.2000 and to enforce the affected 

programs using electronic documents 

collected under these programs, together 

with copies of the relevant statutes and 

regulations, signed by the State Attorney 

General or his or her designee, or, in the 

case of an authorized tribe or local 

government program, by the chief 

executive or administrative official or 

officer of the governmental entity, or his 

or her designee; 

(ii) A listing of all the state, tribe, or 

local government electronic document 

receiving systems to accept the 

electronic documents being addressed 

by the program revisions or 

modifications that are covered by the 

application, together with a description 

for each such system that specifies how 

the system meets the applicable 

requirements in § 3.2000 with respect to 

those electronic documents; 

(iii) A schedule of upgrades for the 

electronic document receiving systems 

listed under paragraph (b)(1)(ii) of this 

section that have the potential to affect 

the program’s continued conformance 

with § 3.2000; and 

(iv) Other information that the 

Administrator may request to fully 

evaluate the application. 

(2) A state, tribe, or local government 

that revises or modifies more than one 

authorized program for receipt of 

electronic documents in lieu of paper 

documents may submit a consolidated 

application under this section covering 

more than one authorized program, 

provided the consolidated application 

complies with paragraph (b)(1) of this 

section for each authorized program. 

(3)(i) Within 75 calendar days of 

receiving an application for program 

revision or modification submitted 

under paragraph (b)(1) of this section, 

the Administrator will respond with a 

letter that either notifies the state, tribe, 

or local government that the application 

is complete or identifies deficiencies in 

the application that render the 

application incomplete. The state, tribe, 

or local government receiving a notice 

of deficiencies may amend the 

application and resubmit it. Within 30 

calendar days of receiving the amended 

application, the Administrator will 

respond with a letter that either notifies 

the applicant that the amended 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59883 

application is complete or identifies 

remaining deficiencies that render the 

application incomplete. 

(ii) If a state, tribe, or local 

government receiving notice of 

deficiencies under paragraph (b)(3)(i) of 

this section does not remedy the 

deficiencies and resubmit the subject 

application within a reasonable period 

of time, the Administrator may act on 

the incomplete application under 

paragraph (c) of this section. 

(c)(1) The Administrator will act on 

an application by approving or denying 

the state’s, tribe’s or local government’s 

request for program revision or 

modification. 

(2) Where a consolidated application 

submitted under paragraph (b)(2) of this 

section addresses revisions or 

modifications to more than one 

authorized program, the Administrator 

may approve or deny the request for 

revision or modification of each 

authorized program in the application 

separately; the Administrator need not 

take the same action with respect to the 

requested revisions or modifications for 

each such program. 

(3) When an application under 

paragraph (b) of this section requests 

revision or modification of an 

authorized public water system program 

under part 142 of this title, the 

Administrator will, in accordance with 

the procedures in paragraph (f) of this 

section, provide an opportunity for a 

public hearing before a final 

determination pursuant to paragraph 

(c)(1) of this section with respect to that 

component of the application. 

(4) Except as provided under 

paragraph (c)(4)(i) and (ii) of this 

section, if the Administrator does not 

take any action under paragraph (c)(1) of 

this section on a specific request for 

revision or modification of a specific 

authorized program addressed by an 

application submitted under paragraph 

(b) of this section within 180 calendar 

days of notifying the state, tribe, or local 

government under paragraph (b)(3) of 

this section that the application is 

complete, the specific request for 

program revision or modification for the 

specific authorized program is 

considered automatically approved by 

EPA at the end of the 180 calendar days 

unless the review period is extended at 

the request of the state, tribe, or local 

government submitting the application. 

(i) Where an opportunity for public 

hearing is required under paragraph 

(c)(3) of this section, the Administrator’s 

action on the requested revision or 

modification will be in accordance with 

paragraph (f) of this section. 

(ii) Where a requested revision or 

modification addressed by an 

application submitted under paragraph 

(b) of this section is to an authorized 

program with an existing electronic 

document receiving system, and where 

notification under paragraph (b)(3) of 

this section that the application is 

complete is executed after October 13, 

2007, if the Administrator does not take 

any action under paragraph (c)(1) of this 

section on the specific request for 

revision or modification within 360 

calendar days of such notification, the 

specific request is considered 

automatically approved by EPA at the 

end of the 360 calendar days unless the 

review period is extended at the request 

of the state, tribe, or local government 

submitting the application. 

(d) Except where an opportunity for 

public hearing is required under 

paragraph (c)(3) of this section, EPA’s 

approval of a program revision or 

modification under this section will be 

effective upon publication of a notice of 

EPA’s approval of the program revision 

or modification in the Federal Register. 

EPA will publish such a notice 

promptly after approving a program 

revision or modification under 

paragraph (c)(1) of this section or after 

an EPA approval occurs automatically 

under paragraph (c)(4) of this section. 

(e) If a state, tribe, or local government 

submits material to amend its 

application under paragraph (b)(1) of 

this section after the date that the 

Administrator sends notification under 

paragraph (b)(3)(i) of this section that 

the application is complete, this new 

submission will constitute withdrawal 

of the pending application and 

submission of a new, amended 

application for program revision or 

modification under paragraph (b)(1) of 

this section, and the 180-day time 

period in paragraph (c)(4) of this section 

or the 360-day time period in paragraph 

(c)(4)(ii) of this section will begin again 

only when the Administrator makes a 

new determination and notifies the 

state, tribe, or local government under 

paragraph (b)(3)(i) of this section that 

the amended application is complete. 

(f) For an application under this 

section that requests revision or 

modification of an authorized public 

water system program under part 142 of 

this chapter: 

(1) The Administrator will publish 

notice of the Administrator’s 

preliminary determination under 

paragraph (c)(1) of this section in the 

Federal Register, stating the reasons for 

the determination and informing 

interested persons that they may request 

a public hearing on the Administrator’s 

determination. Frivolous or 

insubstantial requests for a hearing may 

be denied by the Administrator; 

(2) Requests for a hearing submitted 

under this section must be submitted to 

the Administrator within 30 days after 

publication of the notice of opportunity 

for hearing in the Federal Register. The 

Administrator will give notice in the 

Federal Register of any hearing to be 

held pursuant to a request submitted by 

an interested person or on the 

Administrator’s own motion. Notice of 

hearing will be given not less than 15 

days prior to the time scheduled for the 

hearing; 

(3) The hearing will be conducted by 

a designated hearing officer in an 

informal, orderly, and expeditious 

manner. The hearing officer will have 

authority to take such action as may be 

necessary to assure the fair and efficient 

conduct of the hearing; and 

(4) After reviewing the record of the 

hearing, the Administrator will issue an 

order either affirming the determination 

the Administrator made under 

paragraph (c)(1) of this section or 

rescinding such determination and will 

promptly publish a notice of the order 

in the Federal Register. If the order is 

to approve the program revision or 

modification, EPA’s approval will be 

effective upon publication of the notice 

in the Federal Register. If no timely 

request for a hearing is received and the 

Administrator does not determine to 

hold a hearing on the Administrator’s 

own motion, the Administrator’s 

determination made under paragraph 

(c)(1) of this section will be effective 30 

days after notice is published pursuant 

to paragraph (f)(1) of this section. 

§ 3.2000 What are the requirements 

authorized state, tribe, and local programs’

reporting systems must meet? 

(a) Authorized programs that receive 

electronic documents in lieu of paper to 

satisfy requirements under such 

programs must: 

(1) Use an acceptable electronic 

document receiving system as specified 

under paragraphs (b) and (c) of this 

section; and 

(2) Require that any electronic 

document must bear the valid electronic 

signature of a signatory if that signatory 

would be required under the authorized 

program to sign the paper document for 

which the electronic document 

substitutes, unless the program has been 

approved by EPA to accept a 

handwritten signature on a separate 

paper submission. The paper 

submission must contain references to 

the electronic document sufficient for 

legal certainty that the signature was 

executed with the intention to certify to, 

attest to, or agree to the content of that 

electronic document. 

59884 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

(b) An electronic document receiving 

system that receives electronic 

documents submitted in lieu of paper 

documents to satisfy requirements 

under an authorized program must be 

able to generate data with respect to any 

such electronic document, as needed 

and in a timely manner, including a 

copy of record for the electronic 

document, sufficient to prove, in private 

litigation, civil enforcement 

proceedings, and criminal proceedings, 

that: 

(1) The electronic document was not 

altered without detection during 

transmission or at any time after receipt; 

(2) Any alterations to the electronic 

document during transmission or after 

receipt are fully documented; 

(3) The electronic document was 

submitted knowingly and not by 

accident; 

(4) Any individual identified in the 

electronic document submission as a 

submitter or signatory had the 

opportunity to review the copy of record 

in a human-readable format that clearly 

and accurately associates all the 

information provided in the electronic 

document with descriptions or labeling 

of the information and had the 

opportunity to repudiate the electronic 

document based on this review; and 

(5) In the case of an electronic 

document that must bear electronic 

signatures of individuals as provided 

under paragraph (a)(2) of this section, 

that: 

(i) Each electronic signature was a 

valid electronic signature at the time of 

signing; 

(ii) The electronic document cannot 

be altered without detection at any time 

after being signed; 

(iii) Each signatory had the 

opportunity to review in a humanreadable format the content of the 

electronic document that he or she was 

certifying to, attesting to or agreeing to 

by signing; 

(iv) Each signatory had the 

opportunity, at the time of signing, to 

review the content or meaning of the 

required certification statement, 

including any applicable provisions that 

false certification carries criminal 

penalties; 

(v) Each signatory has signed either an 

electronic signature agreement or a 

subscriber agreement with respect to the 

electronic signature device used to 

create his or her electronic signature on 

the electronic document; 

(vi) The electronic document 

receiving system has automatically 

responded to the receipt of the 

electronic document with an 

acknowledgment that identifies the 

electronic document received, including 

the signatory and the date and time of 

receipt, and is sent to at least one 

address that does not share the same 

access controls as the account used to 

make the electronic submission; and 

(vii) For each electronic signature 

device used to create an electronic 

signature on the document, the identity 

of the individual uniquely entitled to 

use the device and his or her relation to 

any entity for which he or she will sign 

electronic documents has been 

determined with legal certainty by the 

issuing state, tribe, or local government. 

In the case of priority reports identified 

in the table in Appendix 1 of Part 3, this 

determination has been made before the 

electronic document is received, by 

means of: 

(A) Identifiers or attributes that are 

verified (and that may be re-verified at 

any time) by attestation of disinterested 

individuals to be uniquely true of (or 

attributable to) the individual in whose 

name the application is submitted, 

based on information or objects of 

independent origin, at least one item of 

which is not subject to change without 

governmental action or authorization; or 

(B) A method of determining identity 

no less stringent than would be 

permitted under paragraph (b)(5)(vii)(A) 

of this section; or 

(C) Collection of either a subscriber 

agreement or a certification from a local 

registration authority that such an 

agreement has been received and 

securely stored. 

(c) An authorized program that 

receives electronic documents in lieu of 

paper documents must ensure that: 

(1) A person is subject to any 

appropriate civil, criminal penalties or 

other remedies under state, tribe, or 

local law for failure to comply with a 

reporting requirement if the person fails 

to comply with the applicable 

provisions for electronic reporting. 

(2) Where an electronic document 

submitted to satisfy a state, tribe, or 

local reporting requirement bears an 

electronic signature, the electronic 

signature legally binds or obligates the 

signatory, or makes the signatory 

responsible, to the same extent as the 

signatory’s handwritten signature on a 

paper document submitted to satisfy the 

same reporting requirement. 

(3) Proof that a particular electronic 

signature device was used to create an 

electronic signature that is included in 

or logically associated with an 

electronic document submitted to 

satisfy a state, tribe, or local reporting 

requirement will suffice to establish that 

the individual uniquely entitled to use 

the device at the time of signature did 

so with the intent to sign the electronic 

document and give it effect. 

(4) Nothing in the authorized program 

limits the use of electronic documents 

or information derived from electronic 

documents as evidence in enforcement 

proceedings. 

Appendix 1 to Part 3—Priority Reports 

Category Description 40 CFR Citation 

Required Reports 

State Implementation Plan .............. Emissions data reports for mobile sources ........................................... 51.60(c). 

Excess Emissions and Monitoring 

Performance Report Compliance 

Notification Report.

Excess emissions and monitoring performance report detailing the 

magnitude of excess emissions, and provides the date, time, and 

system status at the time of the excess emission.

60.7(c), 60.7(d). 

New Source Performance Standards Reporting Requirements.Semi-annual reports (quarterly, if report is approved for electronic 

submission by the permitting authority) on sulfur dioxide, nitrous 

oxides and particulate matter emission (includes reporting requirements in Subparts A through DDDD).

60.49a(e) & (j) & (v), 60.49b(v). 

Semi-annual Operations and Corrective Action Reports.Semi-annual report provides information on a company’s exceedance 

of its sulfur dioxide emission rate, sulfur content of the fresh feed, 

and the average percent reduction and average concentration of 

sulfur dioxide. When emissions data is unavailable, a signed statement is required which documents the changes, if any, made to the 

emissions control system that would impact the company’s compliance with emission limits.

60.107(c), 60.107(d). 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59885 

Category Description 40 CFR Citation 

National Emission Standards for 

Hazardous Air Pollutants Reporting Requirements.

Include such reports as: Annual compliance, calculation, initial startup, compliance status, certifications of compliance, waivers from 

compliance certifications, quarterly inspection certifications, operations, and operations and process change.

61.11, 61.24(a)(3) & (a)(8), 

61.70(c)(1) & (c)(2)(v) & (c)(3) & 

(c)(4)(iv), 61.94(a) & (b)(9), 

61.104(a) & (a)(1)(x) & (a)(1)(xi) 

& (a)(1)(xvi), 61.138(e) & (f), 

61.165(d)(2) & (d)(3) & (d)(4) & 

(f)(1) & (f)(2) &(f)(3), 

61.177(a)(2) & (c)(1) & (c)(2) & 

(c)(3) & (e)(1) & (e)(3), 

61.186(b)(1) & (b)(2) & (b)(3) & 

(c)(1) & (f)(1), 61.247(a)(1) & 

(a)(4) & (a)(5)(v) & (b)(5) & (d), 

61.254(a)(4), 61.275(a) & (b) & 

(c), 61.305(f) & (i), 61.357(a) & 

(b) & (c) & (d), 63.9(h). 

Hazardous Air Pollutants Compliance Report.Reports containing results from performance test, opacity tests, and 

visible emissions tests. Progress reports; periodic and immediate 

startup, shutdown, and malfunction reports; results from continuous 

monitoring system performance evaluations; excess emissions and 

continuous monitoring system performance report; or summary report.

63.10(d), 63.10(e)(1), 63.10(e)(3). 

Notifications and Reports ................ Reports that document a facility’s initial compliance status, notification of initial start-up, and periodic reports which includes the startup, shutdown, and malfunction reports discussed in 40 CFR 

65.6(c).

65.5(d), 65.5(e). 

Continuous Emissions Monitoring ... Quarterly emissions monitoring reports and opacity reports which 

document a facility’s excess emission.

75.64, 75.65. 

Notice of Fuel or Fuel Additive 

Registration and Health Effects 

Testing.

Registration of new fuels and additives, and the submission and certification of health effect data.79.10, 79.11, 79.20, 79.21, 79.51. 

Manufacture In-Use and Product 

Line Emissions Testing.

Reports that document the emissions testing results generated from 

the in-use testing program for new and in-use highway vehicle ignition engines; non-road spark-ignition engines; marine spark-ignition 

engines; and locomotives and locomotive engines.

86.1845, 86.1846, 86.1847, 

90.113, 90.1205, 90.704, 

91.805, 91.504, 92.607, 92.508, 

92.509. 

Industrial and Publicly Owned 

Treatment Works Reports.

Discharge monitoring reports for all individual permittees—including 

baseline reports, pretreatment standards report, periodic compliance reports, and reports made by significant industrial users.

122.41(l)(4)(i), 403.12(b) & (d) & 

(e) & (h). 

Event Driven Notices 

State Implementation Plan .............. Owners report emissions data from stationary sources ........................ 51.211. 

Report For Initial Performance Test Report that provides the initial performance test results, site-specific 

operating limits, and, if installed, information on the bag leak detection device used by the facility.

60.2200 (initial performance tests). 

Emissions Control Report ............... Report submitted by new sources within 90 days of set-up which describes emission control equipment used, processes which generate asbestos-containing waste material, and disposal information.61.153(a)(1), 61.153(a)(4)(i), 

61.153(a)(5)(ii). 

State Operating Permits—Permit 

Content.

Monitoring and deviation reports under the State Operating Permit .... 70.6(a)(3)(iii)(A), 70.6(a)(3)(iii)(B). 

Title V Permits—Permit Content ..... Monitoring and deviation reports under the Federal Operating Permit 71.6(a)(3)(iii). 

Annual Export Report ...................... Annual report summarizing the amount and type of hazardous waste 

exported.

262.56(a). 

Exceptions Reports ......................... Reports submitted by a generator when the generator has not received confirmation from the Treatment, Storage, and Disposal Facility (TSDF) that it received the generator’s waste and when hazardous waste shipment was received by the TSDF. For exports, reports submitted when the generator has not received a copy of the 

manifest from the transporter with departure date and place of export indicated; and confirmation from the consignee that the hazardous waste was received or when the hazardous waste is returned to the U.S.

262.42, 262.55. 

Contingency Plan Implementation 

Reports.

Follow-up reports made to the Agency for all incidents noted in the 

operating record which required the implementation of a facility’s 

contingency plan.

264.56(j), 265.56(j). 

Significant Manifest Discrepancy 

Report.

Report filed by Treatment, Storage, and Disposal Facilities (TSDF) 

within 15 days of receiving wastes, when the TSDF is unable to resolve manifest discrepancies with the generator.

264.72(b), 265.72(b). 

Unmanifested Waste Report ........... Report that documents hazardous waste received by a Treatment, 

Storage, and Disposal Facility without an accompanying manifest.

264.76, 265.76. 

Noncompliance Report .................... An owner/operator submitted report which documents hazardous 

waste that was placed in hazardous waste management units in 

noncompliance with 40 CFR sections 264.1082(c)(1) and (c)(2); 

264.1084(b); 264.1035(c)(4); or 264.1033(d).

264.1090. 

59886 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

Category Description 40 CFR Citation 

Notification—Low Level Mixed 

Waste.

One-time notification concerning transportation and disposal of conditionally exempted waste.266.345. 

Notification—Land Disposal Restrictions.One-time notification and certification that characteristic waste is no 

longer hazardous.

268.9(d). 

Underground Storage Tank Notification.Underground Storage Tank system notifications concerning design, 

construction, and installation. As well as when systems are being 

placed in operation. (EPA Form 7530–1 or state version.).

280.22. 

Free Product Removal Report and 

Subsequent Investigation Report.

Report written and submitted within 45 days after confirming a free 

product release, including information on the release and recovery 

methods used for the free product, and when test indicate presence of free product, response measures.

280.64, 280.65. 

Manufacture or Import 

Premanufacture Notification.

Premanufacture notification of intent to begin manufacturing, importing, or processing chemicals identified in Subpart E for significant 

new use (forms 7710–56 and 7710–25).

720.102, 721.25. 

Permit Applications 1

State Implementation Plan .............. Information describing the source, its construction schedule, and the 

planned continuous emissions reductions system.

52.21(n). 

State Operating Permits .................. Reports, notices, or other written submissions required by a State 

Operating Permit.

70.6(c)(1). 

Title V Permits—Permit Content ..... Reports, notices, or other written submissions required by a Title V 

Operating Permit.

71.6(c)(1), 71.25(c)(1). 

Title V Permits ................................. Specific criteria for permit modifications and or revisions, including a 

certification statement by a responsible official.

71.7(e(2)(ii)(c). 

Reclaimer Certification .................... Certification made by a reclaimer that the refrigerant was reprocessed according to specifications and that no more than 1.5% of 

the refrigerant was released during the reclamation.

82.164. 

Application for Certification and 

Statement of Compliance.

Control of Emissions for New and In-Use Highway Vehicles and Engines statement of compliance made by manufacturer, attesting 

that the engine family complies with standards for new and in-use 

highway vehicles and engines.

86.007–21 (heavy duty), 1844–01 

(light duty). 

Application for Certification ............. Application made by engine manufacturer to obtain certificate of conformity.89.115, 90.107, 91.107, 92.203, 

94.203. 

National Pollutant Discharge Elimination System.National Pollutant Discharge Elimination System (NPDES) Permits 

and Renewals (includes individual permit applications, NPDES 

General Form 1, and NPDES Forms 2A–F, and 2S).

122.21. 

Resource Conservation and Recovery Act Permit Applications and 

Modifications.

Signatures for permit applications and reports; submission of permit 

modifications. (This category excludes Class I permit modifications 

(40 CFR 270.42, Appendix I) that do not require prior approval).

270.11, 270.42. 

Certifications of Compliance/Non-Applicability 

State Implementation Plan Requirements.State implementation plan certifications for testing, inspection, enforcement, and continuous emissions monitoring.51.212(c), 51.214(e). 

Certification Statement .................... Chemical Accident Prevention Provisions—Risk Management Plan 

certification statements.

68.185. 

Title V Permits ................................. Federal compliance certifications and permit applications .................... 70.5(c)(9), 70.5(d), 70.6(c)(5). 

State Operating Permits .................. State compliance certifications and permit applications ....................... 71.5(c)(9), 71.5(d), 71.24(f). 

Annual and Other Compliance Certification Reports.Annual compliance certification report and is submitted by units subject to acid rain emissions limitations.72.90. 

Annual Compliance Certification 

Report, Opt-In Report, and Confirmation Report.

Annual compliance certification report which is submitted in lieu of 

annual compliance certification report listed in Subpart I of Part 72.

74.43. 

Quarterly Reports and Compliance 

Certifications.

Continuous Emission Monitoring certifications, monitoring plans, and 

quarterly reports for NOX emissions.

75.73. 

Certification Letters Recovery and 

Recycling Equipment, Motor Vehicle Air Conditioners Recycling 

Program, Detergent Package.

Protection of Stratospheric Ozone: Recycling & Emissions Reduction. 

Acquisition of equipment for recovery or recycling made by auto repair service technician and Fuels and Fuel Additives Detergent additive certification.

79.4, 80.161, 82.162, 82.42. 

Response Plan Cover Sheet .......... Oil Pollution Prevention certification to the truth and accuracy of information.112 (Appendix f). 

Closure Report ................................ Report which documents that closure was in accordance with closure 

plan and/or details difference between actual closure and the procedures outlined in the closure plan.

146.71. 

Certification of Closure and Post 

Closure Care, Post-Closure Notices.

Certification that Treatment, Storage, and Disposal Facilities (TSDF) 

are closed in accordance with approved closure plan or post-closure plan.

264.115, 264.119, 264.119(b)(2), 

264.120, 265.115, 

265.119(b)(2), 265.120, 265.19. 

Certification of Testing Lab Analysis Certification that the testing and/or lab analyses required for the treatment demonstration phase of a two-phase permit was conducted.270.63. 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59887 

Category Description 40 CFR Citation 

Periodic Certification ....................... Certification that facility is operating its system to provide equivalent 

treatment as in initial certification.

437.41(b). 

1 Included within each permit application category, though sometimes not listed, are the permits submitted to run/operate/maintain facilities 

and/or equipment/products under EPA or authorized programs. 

PART 9—OMB APPROVALS UNDER 

THE PAPERWORK REDUCTION ACT 

■ 1. The authority citation for part 9 

continues to read as follows: 

Authority: 7 U.S.C. 135 et seq., 136–136y; 

15 U.S.C. 2001, 2003, 2005, 2006, 2601–2671; 

21 U.S.C. 331j, 346a, 31 U.S.C. 9701; 33 

U.S.C. 125l et seq., 1311, 1313d, 1314, 1318, 

1321, 1326, 1330, 1342, 1344, 1345 (d) and 

(e), 1361; E.O. 11735, 38 FR 21243, 3 CFR, 

1971–1975 Comp. p. 973; 42 U.S.C. 241, 

242b, 243, 246, 300f, 300g, 300g-1, 300g-2, 

300g-3, 300g-4, 300g-5, 300g-6, 300j-1, 300j2, 300j-3, 300j-4, 300j-9, 1857 et seq., 6901–

6992k, 7401–7671q, 7542, 9601–9657, 11023, 

11048. 

■ 2. Section 9.1 is amended by adding 

a new entry in numerical order for part 

3 to read as follows: 

§ 9.1 OMB approvals under the Paperwork 

Reduction Act. 

* * * * * 

40 CFR citation OMB 

Control No. 

* * * * * 

Cross-Media Electronic Reporting 

Part 3 ........................................ 2025–0003 

* * * * * 

PART 51—REQUIREMENTS FOR 

PREPARATION, ADOPTION, AND 

SUBMITTAL OF IMPLEMENTATION 

PLANS 

■ 1. The authority citation for part 51 

continues to read as follows: 

Authority: 23 U.S.C. 101; 42 U.S.C. 7401–

7671q. 

■ 2. Section 51.286 is added to Subpart 

O to read as follows: 

§ 51.286 Electronic reporting. 

States that wish to receive electronic 

documents must revise the State 

Implementation Plan to satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting). 

PART 60—STANDARDS OF 

PERFORMANCE FOR NEW 

STATIONARY SOURCES 

■ 1. The authority citation for part 60 

continues to read as follows: 

Authority: 42 U.S.C. 7401–7601. 

■ 2. Section 60.25(b)(1) is amended by 

adding a sentence to the end of the 

paragraph to read as follows: 

§ 60.25 Emission inventories, source 

surveillance, reports. 

* * * * * 

(b)(1) * * * Submission of electronic 

documents shall comply with the 

requirements of 40 CFR part 3—

(Electronic reporting). 

* * * * * 

PART 63—NATIONAL EMISSION 

STANDARDS FOR HAZARDOUS AIR 

POLLUTANTS FOR SOURCE 

CATEGORIES 

■ 1. The authority citation for part 63 

continues to read as follows: 

Authority: 42 U.S.C. 7401 et seq. 

■ 2. Section 63.91 is amended by adding 

a new paragraph (d)(5)to read as 

follows: 

§ 63.91 Criteria for straight delegation and 

criteria common to all approved options. 

* * * * * 

(d) * * * 

(5) Electronic documents. Submission 

of electronic documents shall comply 

with the requirements of 40 CFR part 

3—(Electronic reporting). 

* * * * * 

PART 69—SPECIAL EXEMPTIONS 

FROM REQUIREMENTS OF THE 

CLEAN AIR ACT 

■ 1. The authority citation for part 69 

continues to read as follows: 

Authority: 42 U.S.C. 7545(c), (g) and (i), 

and 7625–1. 

■ 2. Section 69.13 is amended by adding 

a new paragraph (b)(1)(v) to read as 

follows: 

§ 69.13 Title V conditional exemption. 

* * * * * 

(b) * * * 

(1) * * * 

(v) If the program chooses to accept 

electronic documents it must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

■ 3. Section 69.22 is amended by adding 

a new paragraph (b)(1)(v) to read as 

follows: 

§ 69.22 Title V conditional exemption. 

* * * * * 

(b) * * * 

(1) * * * 

(v) If the program chooses to accept 

electronic documents it must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

■ 4. Section 69.32 is amended by adding 

a new paragraph (b)(1)(v) to read as 

follows: 

§ 69.32 Title V conditional exemption. 

* * * * * 

(b) * * * 

(1) * * * 

(v) If the program chooses to accept 

electronic documents it must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

PART 70—STATE OPERATING PERMIT 

PROGRAMS 

■ 1. The authority citation for part 70 

continues to read as follows: 

Authority: 42 U.S.C. 7401, et seq. 

■ 2. Section 70.1 is amended by adding 

a new paragraph (f) to read as follows: 

§ 70.1 Program overview. 

* * * * * 

(f) States that choose to receive 

electronic documents must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting) in their program. 

PART 71—FEDERAL OPERATING 

PERMIT PROGRAMS 

■ 1. The authority citation for part 71 

continues to read as follows: 

Authority: 42 U.S.C. 7401, et seq. 

■ 2. Section 71.10 is amended by adding 

a new sentence to the end of paragraph 

(a) to read as follows: 

§ 71.10 Delegation of part 71 program. 

(a) * * * Delegate agencies that choose 

to receive electronic documents as part 

of their delegated program must satisfy 

the requirements of 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

PART 123—STATE PROGRAM 

REQUIREMENTS 

■ 1. The authority citation for part 123 

continues to read as follows: 

Authority: Clean Water Act, 33 U.S.C. 1251 

et seq. 

59888 Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 

■ 2. Section 123.25 is amended by 

revising paragraphs (a)(44) and (a)(45), 

adding the phrase ‘‘Except for paragraph 

(a)(46) of this section,’’ at the beginning 

of the Note to paragraph (a), and adding 

a new paragraph (a)(46) to read as 

follows: 

§ 123.25 Requirements for permitting. 

(a) * * * 

(44) § 122.35 (As an operator of a 

regulated small MS4, may I share the 

responsibility to implement the 

minimum control measures with other 

entities?); 

(45) § 122.36 (As an operator of a 

regulated small MS4, what happens if I 

don’t comply with the application or 

permit requirements in §§ 122.33 

through 122.35?); and 

(46) For states that wish to receive 

electronic documents, 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

PART 142—NATIONAL PRIMARY 

DRINKING WATER REGULATIONS 

IMPLEMENTATION 

■ 1. The authority citation for part 142 

continues to read as follows: 

Authority: 42 U.S.C. 300f, 300g-1, 300g-2, 

300g-3, 300g-4, 300g-5, 300g-6, 300j-4, 300j9, and 300j-11. 

■ 2. Section 142.10 is amended by 

redesignating paragraph (g) as paragraph 

(h) and by adding a new paragraph (g) 

to read as follows: 

§ 142.10 Requirements for a determination 

of primary enforcement responsibility. 

* * * * * 

(g) Has adopted regulations consistent 

with 40 CFR Part 3—(Electronic 

reporting) if the state receives electronic 

documents. 

* * * * * 

PART 145—REQUIREMENTS FOR 

STATE PROGRAMS 

■ 1. The authority citation for part 145 

continues to read as follows: 

Authority: 42 U.S.C. 300f et seq. 

■ 2. Section 145.11 is amended by 

revising paragraphs (a)(30), (a)(31), 

(a)(32), and adding paragraph (a)(33) to 

read as follows: 

§ 145.11 Requirements for permitting. 

(a) * * * 

(30) Section 124.12(a)—(Public 

hearings); 

(31) Section 124.17 (a) and (c)—

(Response to comments); 

(32) Section 144.88—(What are the 

additional requirements?); and 

(33) For states that wish to receive 

electronic documents, 40 CFR Part 3—

(Electronic reporting). 

* * * * * 

PART 162—STATE REGISTRATION OF 

PESTICIDE PRODUCTS 

■ 1. The authority citation for part 162 

continues to read as follows: 

Authority: 7 U.S.C. 136v, 136w. 

■ 2. Section 162.153 is amended by 

adding a paragraph (a)(6) to read as 

follows: 

§ 162.153 State registration procedures. 

(a) * * * 

(6) Electronic Reporting under State 

Registration of Pesticide Products for 

Special Local Needs. States that choose 

to receive electronic documents under 

the regulations pertaining to state 

registration of pesticides to meet special 

local needs, must ensure that the 

requirements of 40 CFR Part 3—

(Electronic reporting) are satisfied by 

their state procedures for such 

registrations. 

* * * * * 

PART 233—404 STATE PROGRAM 

REGULATIONS 

■ 1. The authority citation for part 233 

continues to read as follows: 

Authority: 33 U.S.C. 1251 et seq. 

■ 2. A new § 233.39 is added to Subpart 

D to read as follows: 

§ 233.39 Electronic reporting. 

States that choose to receive 

electronic documents must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting) in their state 

program. 

PART 257—CRITERIA FOR 

CLASSIFICATION OF SOLID WASTE 

DISPOSAL FACILITIES AND 

PRACTICES 

■ 1. The authority citation for part 257 

continues to read as follows: 

Authority: 42 U.S.C. 6907(a)(3), 6912(a)(1), 

6944(a) and 6949(c), 33 U.S.C. 1345(d) and 

(e). 

■ 2. Section 257.30 is amended by 

adding a new paragraph (d) to read as 

follows: 

§ 257.30 Recordkeeping requirements. 

* * * * * 

(d) The Director of an approved state 

program may receive electronic 

documents only if the state program 

includes the requirements of 40 CFR 

Part 3—(Electronic reporting). 

PART 258—CRITERIA FOR MUNICIPAL 

SOLID WASTE LANDFILLS 

■ 1. The authority citation for part 258 

continues to read as follows: 

Authority: 33 U.S.C. 1345(d) and (e); 42 

U.S.C. 6902(a), 6907, 6912(a), 6944, 6945(c) 

and 6949a(c). 

■ 2. Section 258.29 is amended by 

adding a new paragraph (d) to read as 

follows: 

§ 258.29 Recordkeeping requirements. 

* * * * * 

(d) The Director of an approved state 

program may receive electronic 

documents only if the state program 

includes the requirements of 40 CFR 

Part 3—(Electronic reporting). 

PART 271—REQUIREMENTS FOR 

AUTHORIZATION OF STATE 

HAZARDOUS WASTE PROGRAMS 

■ 1. The authority citation for part 271 

continues to read as follows: 

Authority: 42 U.S.C. 6905, 6912 and 6926. 

■ 2. Section 271.10 is amended by 

revising paragraph (b) to read as follows: 

§ 271.10 Requirements for generators of 

hazardous waste. 

* * * * * 

(b) The State shall have authority to 

require and shall require all generators 

to comply with reporting and 

recordkeeping requirements equivalent 

to those under 40 CFR 262.40 and 

262.41. States must require that 

generators keep these records at least 3 

years. States that choose to receive 

electronic documents must include the 

requirements of 40 CFR Part 3—

(Electronic reporting) in their Program 

(except that states that choose to receive 

electronic manifests and/or permit the 

use of electronic manifests must comply 

with any applicable requirements for 

e-manifest in this section of this 

section). 

* * * * * 

■ 3. Section 271.11 is amended by 

revising paragraph (b) to read as follows: 

§ 271.11 Requirements for transporters of 

hazardous waste. 

* * * * * 

(b) The State shall have authority to 

require and shall require all transporters 

to comply with reporting and 

recordkeeping requirements equivalent 

to those under 40 CFR 263.22. States 

must require that transporters keep 

these records at least 3 years. States that 

choose to receive electronic documents 

must include the requirements of 40 

CFR Part 3—(Electronic reporting) in 

their Program (except that states that 

choose to receive electronic manifests 

Federal Register / Vol. 70, No. 197 / Thursday, October 13, 2005 / Rules and Regulations 59889 

and/or permit the use of electronic 

manifests must comply with any 

applicable requirements for e-manifest 

in this section of this section). 

* * * * * 

■ 4. Section 271.12 is amended by 

revising paragraph (h) to read as 

follows: 

§ 271.12 Requirements for hazardous 

waste management facilities. 

* * * * * 

(h) Inspections, monitoring, 

recordkeeping, and reporting. States that 

choose to receive electronic documents 

must include the requirements of 40 

CFR Part 3—(Electronic reporting) in 

their Program (except that states that 

choose to receive electronic manifests 

and/or permit the use of electronic 

manifests must comply with paragraph 

(i) of this section); 

* * * * * 

PART 281—APPROVAL OF STATE 

UNDERGROUND STORAGE TANK 

PROGRAMS 

■ 1. The authority citation for part 281 

continues to read as follows: 

Authority: 42 U.S.C. 6912, 6991 (c), (d), (e), 

(g). 

■ 2. Section 281.40 is amended by 

revising paragraph (d) to read as 

follows: 

§ 281.40 Requirements for compliance 

monitoring program and authority. 

* * * * * 

(d) State programs must have 

procedures for receipt, evaluation, 

retention and investigation of records 

and reports required of owners or 

operators and must provide for 

enforcement of failure to submit these 

records and reports. States that choose 

to receive electronic documents must 

include the requirements of 40 CFR Part 

3—(Electronic reporting) in their state 

program. 

* * * * * 

PART 403—GENERAL 

PRETREATMENT REGULATIONS FOR 

EXISTING AND NEW SOURCES OF 

POLLUTION 

■ 1. The authority citation for part 403 

continues to read as follows: 

Authority: 33 U.S.C. 1251 et seq. 

■ 2. Section 403.8 is amended by adding 

a new paragraph (g) to read as follows: 

§ 403.8 Pretreatment Program 

Requirements: Development and 

Implementation by POTW. 

* * * * * 

(g) A POTW that chooses to receive 

electronic documents must satisfy the 

requirements of 40 CFR Part 3—

(Electronic reporting). 

■ 3. Section 403.12 is amended by 

adding a new paragraph (r) to read as 

follows: 

§ 403.12 Reporting requirements for 

POTW’s and industrial users. 

* * * * * 

(r) The Control Authority that chooses 

to receive electronic documents must 

satisfy the requirements of 40 CFR Part 

3—(Electronic reporting). 

PART 501—STATE SLUDGE 

MANAGEMENT PROGRAM 

REGULATIONS 

■ 1. The authority citation for part 501 

continues to read as follows: 

Authority: 33 U.S.C. 1251 et seq. 

■ 2. Section 501.15 is amended by 

adding a new paragraph (a)(4) to read as 

follows: 

§ 501.15 Requirements for permitting. 

(a) * * * 

(4) Information requirements: All 

treatment works treating domestic 

sewage shall submit to the Director 

within the time frames established in 

paragraph (d)(1)(ii) of this section the 

information listed in paragraphs (a)(4)(i) 

through (xii) of this section. The 

Director of an approved state program 

that chooses to receive electronic 

documents must satisfy the 

requirements of 40 CFR part 3—

(Electronic reporting). 

* * * * * 

PART 745—LEAD-BASED PAINT 

POISONING PREVENTION IN CERTAIN 

RESIDENTIAL STRUCTURES 

■ 1. The authority citation for part 745 

continues to read as follows: 

Authority: 15 U.S.C. 2605, 2607, 2681–

2692 and 42 U.S.C. 4852d. 

■ 2. Section 745.327 is amended by 

adding a new paragraph (f) to read as 

follows: 

§ 745.327 State or Indian Tribal lead-based 

paint compliance and enforcement 

programs. 

* * * * * 

(f) Electronic reporting under State or 

Indian Tribe programs. States and tribes 

that choose to receive electronic 

documents under the authorized state or 

Indian tribe lead-based paint program, 

must ensure that the requirements of 40 

CFR part 3—(Electronic reporting) are 

satisfied in their lead-based paint 

program. 

PART 763—ASBESTOS 

■ 1. The authority citation for part 763 

continues to read as follows: 

Authority: 15 U.S.C. 2605, 2607(c), 2643, 

and 2646. 

■ 2. Section 763.98 is amended by 

revising paragraphs (a)(1), (b)(3), and 

(d)(3) to read as follows: 

§ 763.98 Waiver; delegation to state. 

(a) General. (1) Upon request from a 

state Governor and after notice and 

comment and an opportunity for a 

public hearing in accordance with 

paragraphs (b) and (c) of this section, 

EPA may waive some or all of the 

requirements of this subpart E if the 

state has established and is 

implementing or intends to implement 

a program of asbestos inspection and 

management that contains requirements 

that are at least as stringent as the 

requirements of this subpart. In 

addition, if the state chooses to receive 

electronic documents, the state program 

must include, at a minimum, the 

requirements of 40 CFR part 3—

(Electronic reporting). 

* * * * * 

(b) * * * 

(3) Detailed reasons, supporting 

papers, and the rationale for concluding 

that the state’s asbestos inspection and 

management program provisions for 

which the request is made are at least 

as stringent as the requirements of 

Subpart E of this part, and that, if the 

state chooses to receive electronic 

documents, the state program includes, 

at a minimum, the requirements of 40 

CFR part 3—(Electronic reporting). 

* * * * * 

(d) * * * 

(3) The state has an enforcement 

mechanism to allow it to implement the 

program described in the waiver request 

and any electronic reporting 

requirements are at least as stringent as 

40 CFR part 3—(Electronic reporting). 

* * * * * 

■ 3. Appendix C to subpart E of part 763 

is amended by adding paragraph (I) to 

section I to read as follows: 

Appendix C to Subpart E of Part 763—

Asbestos Model Accreditation Plan 

I. Asbestos Model Accreditation Plan for 

States 

* * * * * 

(I) Electronic Reporting. 

States that choose to receive electronic 

documents must include, at a minimum, the 

requirements of 40 CFR Part 3—(Electronic 

reporting) in their programs. 

* * * * * 

[FR Doc. 05–19601 Filed 10–12–05; 8:45 am] 

BILLING CODE 6560–50–P